[2106 by GPT-5.6 Sol] Darwin ARM64 packaged reprobe: preserve OS Safe Storage identity across launches - #2108

/ultrafix goal=9 max=3

🔄 Ultrafix loop started (goal: 9/10, max cycles: 3)

First action: /review

💡 Tip: Remove the ultrafix label from this PR to stop further ultrafix cycles.

Both native Darwin packaged jobs are now stuck for more than 20 minutes inside the new signing wrapper, versus the prior 1–3 minute complete lanes. This is a merge blocker independent of the Safe Storage objective. Keep this PR and exact transport base; do not merge or touch Linux/Windows/production signing.

Add fixed, secret-free setup stage markers before and after every potentially blocking phase: key/certificate generation, keychain creation/selection, trust installation, identity import, partition-list update, application signing, initial signature verification, pair/reprobe journey, stable signature verification, trust removal, keychain restoration/deletion, and temporary-file cleanup. Each marker must contain only an allowlisted stage and STARTED/PASSED/FAILED code.

Bound every external security/openssl/codesign/sign/verify operation and the complete wrapper. On macOS do not assume GNU timeout exists; use a tested Node child-process helper or an equivalently robust mechanism that terminates the owned child/process group, drains bounded output, preserves the primary failure, and still runs the EXIT cleanup. Never print command arguments or secret values. Do not merely lengthen the 45-minute job timeout.

Diagnose and remove the actual noninteractive hang, especially any trust, keychain ACL/partition, or nested codesign prompt. Preserve the certificate-backed designated requirement and real os-protected two-process Safe Storage proof. Add direct timeout/cleanup/marker tests, rerun focused gates, and publish the correction to this existing PR. The AI label was already present before this comment.

✅ Applied the requested follow-up changes in commit a4988eb

Summary of Changes

Implemented the Darwin-only PR correction without touching Linux, Windows, or production signing.

Key changes:

• Added allowlisted STARTED/PASSED/FAILED markers for all 12 requested phases in run-packaged-darwin-connect-smoke.sh.
• Added a Node process-group supervisor with bounded output, TERM/KILL escalation, signal propagation, redacted diagnostics, and cleanup grace in run-bounded-darwin-command.mjs.
• Bounded every setup, signing, verification, journey, and cleanup operation, plus the complete Darwin wrapper.
• Removed the signing hot path by enabling inside-out batched codesign calls and disabling irrelevant provisioning-profile work in sign-darwin-packaged-connect.mjs.
• Added per-command verification timeouts in verify-darwin-packaged-connect-signature.mjs.
• Preserved the certificate-bound designated requirement and real two-process os-protected Safe Storage journey.

Verification:

• Focused marker/timeout/cleanup/signature tests: 16 passed.
• Full desktop suite: 443 tests, 418 passed, 25 platform skips.
• Desktop typecheck passed.
• Shell syntax and git diff --check passed.
• No visual preview created because this is CI-only.

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 17m 33s
• Tokens: 4,908,238 (4,867,826 in / 40,412 out)
• Cost: $4.27

Undo Changes • View Task Execution

_{🤖 Generated by ProPR}
Processing comment ID: 5541584292✓

The fresh Darwin ARM64 run now fails deterministically at TRUST_INSTALLATION: security add-trusted-cert -r trustRoot -p codeSign -k DISPOSABLE_KEYCHAIN ROOT_CERT reaches the 30s bound. Cleanup markers all pass, so the hang is isolated and signing is never reached.

Please implement the smallest macOS-only correction that removes this blocking trust mutation while preserving the actual goal: a stable, explicit code-signing identity/designated requirement across the pair and fresh reprobe launches so Electron Safe Storage sees the same app identity. Prefer importing and selecting the disposable signing identity without changing trust settings if codesign can use it directly; otherwise use a non-interactive ephemeral signing approach that proves stable identity. Keep the fixed stage markers and bounded commands, keep strict signature/designated-requirement verification before and after the journey, keep all cleanup/restoration guarantees, and do not touch production signing, secrets, Linux behavior, or Windows behavior.

Add focused tests for the revised non-interactive path and run the current Darwin ARM64 packaged journey.

🛑 Execution Cancelled

The task processing was stopped by user request.

You can post a new comment to restart processing.

Independent audit found two additional merge blockers in current head a4988eb. Please incorporate them in this correction (if the current run has already moved past a point where it can consume this, process this as the immediate next follow-up):

1. The process-group supervisor clears its SIGKILL escalation timer as soon as the group leader closes, without proving descendants exited. A reproduced TERM-ignoring descendant remains alive after timeout. Retain/escalate SIGKILL against the owned process group after the grace period even if the leader has closed, while guarding carefully against PGID reuse. Add a regression test with a descendant that ignores TERM and prove it is gone.

2. Cleanup intent for trust mutation is set only after add-trusted-cert returns. If the command installs trust and then hangs/times out, cleanup skips trust removal. Remove the trust mutation entirely under the requested non-interactive approach; if any trust mutation remains, establish cleanup intent before mutation (or always attempt bounded removal once the root exists) and test partial-success timeout cleanup.

Keep output bounded/secret-safe and preserve all other scope constraints from the prior comment.

✅ Applied the requested follow-up changes in commit d585e76

Summary of Changes

Implemented both merge-blocker corrections without committing.

• Process supervision now retains a dedicated group leader through timeout escalation, preventing PGID reuse and ensuring SIGKILL reaches TERM-ignoring descendants. Added a regression test proving descendant termination.
• Removed all trust installation/removal mutations. Signing directly selects the imported disposable certificate fingerprint, while verification still enforces the unique certificate, strict deep signature, and stable designated requirement.
• Updated fixed stage and cleanup contracts accordingly.

Verification:

• Focused tests: 17/17 passed
• Desktop suite: 420 passed, 25 platform skips
• Desktop/UI typechecks passed
• ESLint, shell syntax, and git diff --check passed

The native Darwin packaged journey remains CI-only on this Linux worker. No visual preview was created because the changes are non-visual.

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 10m 26s
• Tokens: 1,813,274 (1,792,295 in / 20,979 out)
• Cost: $2.06
• Subscription usage: Weekly +85%

Undo Changes • View Task Execution

_{🤖 Generated by ProPR}
Processing comment ID: 5541881164✓

/merge

🔀 Auto-merged 1953-epic-desktop-transport-api into 2106/gpt-5.6-sol-darwin-arm64-packaged-rep-20260904-1325-wuu (clean merge) in commit 3f4424f

No conflicts were found — the merge was verified by an AI agent.

🤖 Verification Details

• Model: gpt-5.6-sol
• Time: 1m 29s

View Task Execution

System-triggered merge conflict resolution

Current combined head 3f4424f (and pre-merge d585e76) fails natively on Darwin ARM64 at APPLICATION_SIGNING immediately after identity import and partition ACL succeed. The current PKCS#12 contains only a leaf issued by a generated root; that root is neither imported nor trusted, and osx-sign suppresses the actionable error. The no-trust signing path is therefore not yet valid.

Please implement the smallest CI-only non-interactive correction and prove it on native Darwin. First make the disposable signing identity internally complete without trust mutation: prefer the already-investigated one-day self-signed code-signing leaf (private key + codeSigning EKU) imported as PKCS#12 and selected by exact SHA1, or otherwise include the complete chain. If osx-sign remains the obstacle, use a bounded direct codesign path with the explicit keychain, exact identity fingerprint, no timestamp, inside-out/deep handling, and the same certificate-bound designated requirement. Do not restore add-trusted-cert or any user/system trust mutation. If certificate-backed signing truly cannot work without trust, use a CI-only stable ad-hoc signature with an explicit fixed designated requirement only if the real pair plus fresh-reprobe Safe Storage journey proves os-protected continuity on both architectures.

Add secret-safe classified diagnostics sufficient to distinguish missing identity/chain, trust rejection, requirements failure, and codesign failure without emitting command output, paths, passwords, fingerprints, or environment values. Preserve strict before/after verification, process-group cleanup guarantees, production signing isolation, and Linux/Windows behavior. Run focused tests and let the native Darwin x64 and ARM64 packaged jobs be authoritative.

✅ Applied the requested follow-up changes in commit 589e10e

Summary of Changes

Implemented the CI-only Darwin correction without trust mutation.

• Generates a one-day self-signed code-signing leaf and imports its private key/certificate as PKCS#12 in run-packaged-darwin-connect-smoke.sh.
• Replaced osx-sign execution with bounded, inside-out direct codesign using the explicit keychain, exact SHA1, no timestamp, preserved metadata, certificate-bound requirement, and strict deep verification in sign-darwin-packaged-connect.mjs.
• Added fixed secret-safe diagnostics for missing identity/chain, trust rejection, requirements failure, and codesign failure.
• Preserved strict before/after verification, native-artifact hashes, cleanup, production signing isolation, and existing Linux/Windows behavior.
• Retained and re-proved SIGKILL escalation against TERM-ignoring descendants.

Verification:

• Focused tests: 22 passed
• Desktop suite: 444 passed, 25 platform skips
• ESLint, shell syntax, and git diff --check: passed
• No visual preview created; this is CI-only

Native Darwin execution could not run on this Linux x64 worker. The existing Darwin x64 and ARM64 packaged jobs must provide the authoritative native signing and Safe Storage proof. No commit was created.

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 14m 22s
• Tokens: 5,397,300 (5,366,043 in / 31,257 out)
• Cost: $4.45

Undo Changes • View Task Execution

_{🤖 Generated by ProPR}
Processing comment ID: 5542208980✓

Independent audit found one remaining process-supervisor cleanup blocker on combined head 3f4424f: the timeout path is fixed, but a nonzero command exit can still strand a TERM-ignoring descendant. Reproduction: command spawns such a descendant with ignored stdio and exits 23; the dedicated guard is released before failure classification, catch sends TERM, then finally clears the SIGKILL escalation timer, leaving the descendant alive.

After the active signing correction publishes, fix all non-success exits (nonzero exit, spawn error, and output-limit/error paths as applicable) so the owned group guard remains valid until descendants are terminated and SIGKILL escalation completes. Guard against PGID reuse as on the timeout path. Add a regression for the nonzero-exit TERM-ignoring descendant and prove the PID is gone. Preserve bounded secret-safe behavior and the active signing correction.

✅ Applied the requested follow-up changes in commit bd8e61e

Summary of Changes

Implemented the process-supervisor cleanup fix.

• Nonzero exits now retain the process-group guard through TERM grace and SIGKILL escalation.
• Inner command spawn errors use the same guarded cleanup path.
• Unexpected supervisor errors await bounded cleanup before timers are cleared.
• Added regression coverage proving a TERM-ignoring descendant exits after its parent returns 23.
• Preserved bounded output, secret-safe diagnostics, and the active signing correction.

Changed:

• run-bounded-darwin-command.mjs
• run-bounded-darwin-command.test.mjs

Verification:

• Focused supervisor/platform tests: 16 passed
• Full desktop suite: 446 passed, 25 skipped
• ESLint passed
• git diff --check passed

No preview created because the change is non-visual. No commit was made.

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 8m 40s
• Tokens: 1,835,045 (1,818,963 in / 16,082 out)
• Cost: $1.77
• Subscription usage: Weekly +1%

Undo Changes • View Task Execution

_{🤖 Generated by ProPR}
Processing comment ID: 5542264275✓

Native Darwin ARM64 job 101070723756 on 589e10e proves APPLICATION_SIGNING passes, including the signers strict deep verification, but INITIAL_SIGNATURE_VERIFICATION then emits CODESIGN_FAILURE. Cleanup passes. This localizes the remaining failure to verifier evidence/command handling, not signing itself.

After the active supervisor correction, replace the fragile requirement for an Authority= line from codesign verbose output with an exact certificate-backed proof suitable for an intentionally untrusted self-signed leaf. Prefer bounded codesign certificate extraction into the existing private temporary directory, compute the extracted leaf SHA1, require it to equal the generated expected SHA1, require exactly the expected certificate evidence, reject ad-hoc signatures, retain identifier and certificate-bound designated-requirement checks, and retain strict deep codesign verification before and after the journey. Clean extracted certificate files with the existing temp cleanup. Keep diagnostics fixed/secret-safe; add focused tests for missing, ambiguous/mismatched, ad-hoc, and valid self-signed certificate evidence. Do not weaken the Safe Storage journey, add trust mutation, or touch production/Linux/Windows behavior. Native Darwin x64 and ARM64 must reach and pass PAIR_REPROBE_JOURNEY.

✅ Applied the requested follow-up changes in commit b9f85d5

Summary of Changes

Implemented the Darwin-only verifier correction.

• Replaced Authority= reliance with bounded codesign certificate extraction into the private temp directory.
• Requires exactly one extracted X.509 leaf and an exact SHA-1 match.
• Preserved ad-hoc rejection, identifier/designated-requirement binding, and strict deep verification before and after the journey.
• Added focused valid self-signed, missing, ambiguous, mismatched, and ad-hoc tests.
• Existing temp cleanup removes extracted certificates.

Key changes: verifier, tests.

Validation:

• Desktop suite: 475 tests, 450 passed, 25 platform-specific skipped.
• Shell syntax and git diff --check: passed.
• Native Darwin x64/ARM64 execution requires the CI matrix and wasn’t available on this Linux worker.

No preview was created because the change is non-visual CI infrastructure.

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 11m 18s
• Tokens: 3,067,631 (3,044,142 in / 23,489 out)
• Cost: $2.84

Undo Changes • View Task Execution

_{🤖 Generated by ProPR}
Processing comment ID: 5542459592✓

Documentation follow-up from independent audit: the desktop README still says Darwin cleanup removes temporary trust, but the current implementation deliberately performs no trust mutation. After the active verifier correction, update that wording to describe deletion/restoration of the disposable keychain and temporary signing material without claiming trust installation/removal. Documentation only; preserve current behavior and tests.

✅ Applied the requested follow-up changes in commit ad8e585

Summary of Changes

Updated apps/desktop/README.md to describe:

• Original keychain configuration restoration
• Disposable keychain deletion
• Temporary signing-material removal

Removed the inaccurate temporary-trust removal claim. No behavior or tests changed. git diff --check passes; no visual preview was needed.

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 1m 34s
• Tokens: 111,651 (110,286 in / 1,365 out)
• Cost: $0.27

Undo Changes • View Task Execution

_{🤖 Generated by ProPR}
Processing comment ID: 5542577122✓

✅ Applied the requested follow-up changes in commit e9fd5d1

Summary of Changes

Implemented the Darwin verifier follow-up.

• Replaced certificate extraction with bounded native codesign --verify --test-requirement evaluation pinned to dev.propr.desktop and the expected leaf SHA-1.
• Retained separate embedded-requirement display, byte-exact before/after stability, and ordinary --verify --deep --strict.
• Added all five fixed secret-safe verifier diagnostics.
• Added coverage for exact argv, self-signed signatures, ad-hoc/unsigned code, wrong leaf/identifier, missing/ambiguous evidence, and stability.
• Preserved cleanup, no-trust, and production isolation constraints.

Validation:

• Focused tests: 17 passed.
• Full desktop suite: 451 passed, 25 platform skips.
• Syntax and git diff --check: passed.
• Only three Darwin verifier/test files changed.
• No visual preview created because this is CI-only.

The system-generated commit will trigger the path-filtered native ARM64/x64 workflow; those real journey results cannot run on this Linux worker.

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 9m 57s
• Tokens: 2,582,700 (2,561,612 in / 21,088 out)
• Cost: $2.39
• Subscription usage: Weekly +1%

Undo Changes • View Task Execution

_{🤖 Generated by ProPR}
Processing comment ID: 5542901295✓

Native ARM64 job 101085420237 on e9fd5d1 localizes the failure exactly to EXPECTED_REQUIREMENT_FAILURE; signature display and signing pass. Correct the codesign test-requirement argv to the canonical single-option form: use one argument such as -R=identifier "dev.propr.desktop" and certificate leaf = H"EXPECTED_SHA1" (or the equivalent --test-requirement=... form), followed by the app. Do not pass --test-requirement and a second expression argument beginning with =. Preserve exact identifier/leaf binding and all other verification/diagnostic/cleanup constraints. Update the exact argv regression to reject the invalid split form, trigger fresh native x64/ARM64, and require both full pair+fresh-reprobe journeys plus stable signature verification to pass.

✅ Applied the requested follow-up changes in commit 8f1554d

Summary of Changes

Implemented the PR #2108 follow-up.

• Corrected codesign argv to ['--verify', '-R=<exact identifier/leaf requirement>', application] in verify-darwin-packaged-connect-signature.mjs.
• Updated the exact argv regression to reject the invalid split form in verify-darwin-packaged-connect-signature.test.mjs.
• Strengthened platform contracts for native x64/ARM64, separate pair/reprobe launches, and stable verification afterward in packaged-connect-platform.test.mjs.

Verification:

• Desktop suite: 476 tests, 451 passed, 25 platform-specific skipped, 0 failed.
• git diff --check: passed.
• Native Darwin jobs will trigger when the system commits/publishes these path-filtered changes.

No visual preview was created because this is CI-only and not user-visible. No commit was made.

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 5m 57s
• Tokens: 1,073,661 (1,066,233 in / 7,428 out)
• Cost: $1.16

Undo Changes • View Task Execution

_{🤖 Generated by ProPR}
Processing comment ID: 5543086525✓

ARM64 job 101088960185 on 8f1554d still fails EXPECTED_REQUIREMENT_FAILURE with canonical single-argument -R, while signing passes. This is now an ARM/untrusted-certificate requirement-evaluation semantic, not argv syntax. Stop using -R as the leaf proof.

Implement separate bounded verifier operations: (1) codesign -d --verbose=4 APP for non-ad-hoc/identifier metadata; (2) a separate codesign -d --extract-certificates PREFIX APP operation, not combined with verbose display; (3) require exactly prefix0 as a regular file, parse it, and match its SHA1 exactly to EXPECTED_SHA1; (4) codesign -d -r- APP and require exact certificate-bound designated requirement plus byte-exact before/after stability; (5) codesign --verify --deep --strict APP. Use a distinct fixed CERTIFICATE_EXTRACTION_FAILURE subcode for the extraction command and preserve existing secret-safe subcodes for other operations. Clean all prefix files in the existing private temp cleanup. Tests must assert the two display/extraction commands are separate, exact argv, exact-one leaf, mismatch/ad-hoc/identifier rejection, and stability. No trust mutation or production/Linux/Windows changes. Fresh Darwin x64/ARM64 must reach and pass PAIR_REPROBE_JOURNEY and STABLE_SIGNATURE_VERIFICATION.

✅ Applied the requested follow-up changes in commit 2da9a0a

Summary of Changes

Implemented the Darwin-only verifier follow-up.

• Removed -R requirement evaluation.
• Added separate bounded metadata and certificate-extraction commands with exact argv.
• Requires exactly prefix0 as a regular, parseable certificate and matches its SHA1.
• Added CERTIFICATE_EXTRACTION_FAILURE.
• Enforces exact certificate-bound designated requirements and byte-stable reprobe evidence.
• Uses separate private initial/stable prefixes cleaned by existing temp-root cleanup.
• Preserved strict deep verification and existing diagnostics.

Validation:

• Desktop script suite: 222 tests, 198 passed, 24 platform skips, 0 failures.
• ESLint passed.
• Shell syntax and git diff --check passed.
• Native Darwin execution remains for x64/ARM64 CI.
• No visual preview created because the change is CI-only.

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 8m 28s
• Tokens: 1,062,440 (1,040,977 in / 21,463 out)
• Cost: $1.53

Undo Changes • View Task Execution

_{🤖 Generated by ProPR}
Processing comment ID: 5543237359✓

ARM64 job 101093272023 on 2da9a0a localizes the failure to CERTIFICATE_EXTRACTION_FAILURE; signing and signature display pass. macOS ARM rejects both -R evaluation and codesign extraction for this intentionally untrusted self-signed identity. Stop iterating those operations.

Use the portable proof chain: (1) bounded security find-certificate -a -Z against the disposable keychain and require exactly the generated SHA1; (2) separate codesign -d --verbose=4 and require exact Identifier=dev.propr.desktop, reject Signature=adhoc, and require a positive numeric Signature size; (3) codesign -d -r- and require the exact embedded designated requirement containing the expected leaf SHA1, with byte-exact before/after stability; (4) codesign --verify --deep --strict; (5) the real pair plus fresh-reprobe journey must report os-protected and prove credential continuity. Together with the direct signer selecting the same exact SHA1, this proves certificate-backed identity without Authority, -R, extraction, or trust mutation.

Remove extraction files/subcodes and stale EXPECTED_REQUIREMENT_FAILURE if now unused. Preserve fixed secret-safe diagnostics for certificate lookup, signature display/evidence, embedded requirement, and strict verification. Add focused tests for duplicate/wrong keychain fingerprint, ad-hoc/zero-or-missing signature size, wrong identifier/leaf, unstable requirement, and strict failure. Native x64/ARM64 must pass the full journey and stable verification.

✅ Applied the requested follow-up changes in commit e4fea05

Summary of Changes

Implemented the PR #2108 follow-up without committing.

• Replaced certificate extraction and -R evaluation with bounded keychain SHA-1 lookup, signature metadata validation, exact designated-requirement evidence, and strict verification in verify-darwin-packaged-connect-signature.mjs.
• Removed extraction prefixes and obsolete diagnostics from the Darwin wrapper.
• Enforced an explicit os-protected journey report while retaining fresh-process credential continuity checks.
• Added all requested negative tests.

Validation passed:

• Desktop/UI typechecks
• Full desktop suite: 453 passed, 25 platform-specific skipped
• Focused suite: 54 passed
• Shell syntax and git diff --check

Native macOS x64/ARM64 execution requires the PR’s CI runners and was not available on this Linux host. No preview was created because the changes are CI-only and not visually perceptible.

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 12m 41s
• Tokens: 5,680,737 (5,653,929 in / 26,808 out)
• Cost: $4.82

Undo Changes • View Task Execution

_{🤖 Generated by ProPR}
Processing comment ID: 5543406076✓

Both e4fea native jobs now confirm all verifier subprocesses succeed and only EVIDENCE_ASSERTION_FAILURE remains. The parser is too format-fragile: it applies one exact whole-output regex to codesign -d -r-, although codesign may emit extra Executable/metadata lines and architecture-specific whitespace/casing. Fix evidence parsing without weakening semantics.

Normalize CRLF, trim lines, require exactly one line beginning designated =>, and validate that line with a whitespace-tolerant/case-tolerant anchored grammar requiring exactly identifier "dev.propr.desktop" AND certificate leaf = H"EXPECTED_SHA1" (no additional OR clauses/requirements). Store that selected canonical line plus newline for the initial proof and require the same normalized selected line after reprobe. Keep exact-one keychain SHA1 and signature metadata checks. Split assertion diagnostics into fixed secret-safe KEYCHAIN_EVIDENCE_FAILURE, SIGNATURE_METADATA_FAILURE, and REQUIREMENT_EVIDENCE_FAILURE so any residual mismatch is attributable. Tests must include codesign outputs with Executable/path and surrounding metadata lines, CRLF/spacing/case variants, duplicate designated lines, wrong identifier/leaf, extra clauses, ad-hoc/missing/zero signature size, and stable/changed requirement. Preserve all command, strict verify, journey, cleanup, no-trust, and platform isolation behavior. Trigger native x64/ARM64 full journeys.

✅ Applied the requested follow-up changes in commit 07c97ad

Summary of Changes

Implemented the follow-up verifier fix.

• Normalizes CRLF and trims lines, selects exactly one designated-requirement line, and validates an anchored whitespace/case-tolerant grammar with the exact identifier and certificate leaf—rejecting extra clauses.
• Stores the normalized selected line plus one newline and compares it after reprobe.
• Adds secret-safe KEYCHAIN_EVIDENCE_FAILURE, SIGNATURE_METADATA_FAILURE, and REQUIREMENT_EVIDENCE_FAILURE diagnostics.
• Preserves all existing verifier commands, strict checks, cleanup, no-trust behavior, and platform isolation.
• Added comprehensive regression coverage in verify-darwin-packaged-connect-signature.test.mjs.

Validation:

• Focused tests: 23/23 passed
• Full desktop suite: 458 passed, 25 platform-specific skipped
• ESLint: passed
• git diff --check: passed

The changed desktop paths trigger the existing native x64 and ARM64 full-journey workflow matrix when published. No visual preview was created because this is CI-only behavior.

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 7m 16s
• Tokens: 1,541,104 (1,527,845 in / 13,259 out)
• Cost: $1.58

Undo Changes • View Task Execution

_{🤖 Generated by ProPR}
Processing comment ID: 5543631504✓

ARM64 job 101102550114 on 07c97ad now passes signing and exact keychain SHA evidence, then fails only SIGNATURE_METADATA_FAILURE. The verbose codesign metadata parser remains format-sensitive. Remove the redundant requirement for exactly one positive numeric Signature size line. Keep a whitespace/case-tolerant explicit rejection of any Signature=adhoc line. Validate the exact identifier through both an Identifier=dev.propr.desktop line when present and, authoritatively, the already required exact embedded designated requirement; do not fail solely because verbose display omits a redundant Identifier/signature-size field on one runner. The exact signer SHA selection, exact-one keychain SHA, exact leaf-bound embedded requirement, strict deep verification, and real os-protected pair+reprobe together are the certificate identity proof.

Split any remaining metadata failure into fixed ADHOC_SIGNATURE_FAILURE and IDENTIFIER_METADATA_FAILURE so it is attributable; no raw output. Add realistic variants with missing Signature size, alternate spacing/case, explicit ad-hoc, duplicate/conflicting identifier, and valid identifier. Preserve all other evidence, cleanup, no-trust, and platform isolation. Native x64/ARM64 must pass full pair+reprobe and stable verification.

✅ Applied the requested follow-up changes in commit f79321e

Summary of Changes

Implemented the requested Darwin metadata-parser follow-up.

• Removed all Signature size requirements.
• Added whitespace/case-tolerant explicit Signature=adhoc rejection.
• Made Identifier= optional, but exact when present; duplicate/conflicting lines fail.
• Added fixed ADHOC_SIGNATURE_FAILURE and IDENTIFIER_METADATA_FAILURE diagnostics.
• Preserved keychain SHA, embedded requirement, strict verification, pair/reprobe, cleanup, and platform isolation.
• Added realistic missing-field, spacing/case, ad-hoc, duplicate/conflicting, and valid identifier tests.

Changed files:

• Verifier
• Verifier tests
• Platform contracts

Validation:

• Focused tests: 25 passed
• All desktop script tests: 206 passed, 24 platform-specific skipped
• Syntax and git diff --check: passed

Native Darwin x64/ARM64 execution requires the macOS CI runners. No visual preview was created because this is CI-only behavior.

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 4m 23s
• Tokens: 633,025 (624,327 in / 8,698 out)
• Cost: $0.88

Undo Changes • View Task Execution

_{🤖 Generated by ProPR}
Processing comment ID: 5543787926✓

Independent audit found a root-signing identity blocker that the latest optional metadata parser must not mask. The signer currently uses --preserve-metadata=identifier,entitlements,flags for every target, including the root app. On ARM64 the packaged root identifier can be absent/different, explaining the missing/conflicting Identifier metadata even though the embedded requirement says dev.propr.desktop.

For the root application signing command, explicitly pass --identifier dev.propr.desktop and preserve only entitlements,flags (not identifier). For nested Mach-O/framework/app targets, continue preserving their existing identifiers/entitlements/flags and do not overwrite them with the root identifier. Keep the exact certificate SHA, keychain, no timestamp, root-only certificate-bound designated requirement, inside-out order, and strict verification. Reinstate/retain the verifier rule that when root Identifier metadata is emitted it must be exactly dev.propr.desktop; after explicit signing, require the native job evidence to include and validate it rather than relying on optional absence. Add exact argv tests distinguishing root from nested targets and a platform contract that rejects root identifier preservation. Native x64/ARM64 must pass signing, initial verification, os-protected pair+reprobe, and stable verification.

✅ Applied the requested follow-up changes in commit bb67c12

Summary of Changes

Implemented the Darwin root-signing correction.

• Root app now uses --identifier dev.propr.desktop and preserves only entitlements,flags; nested targets retain identifier preservation and never receive the root identifier.
• Exact SHA, keychain, no-timestamp signing, root-only certificate requirement, inside-out order, and strict verification remain intact.
• Verifier now requires exactly one root Identifier=dev.propr.desktop during initial and stable verification.
• Added exact argv, identifier-evidence, and platform-contract regression tests.

Files: signer, verifier

Validation:

• Full desktop suite: 462 passed, 25 platform-specific skipped
• git diff --check: passed
• Native macOS x64/ARM64 journeys require the post-commit CI matrix and could not run on this Linux worker.

No visual preview was generated because this is CI-only behavior.

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 6m 9s
• Tokens: 1,076,342 (1,066,757 in / 9,585 out)
• Cost: $1.20

Undo Changes • View Task Execution

_{🤖 Generated by ProPR}
Processing comment ID: 5543879385✓

Independent audit found a proof regression in interim f793 that must be corrected after the active root-identifier task: tests currently accept empty signatureDetails, Signature size=0, and missing signature lines. codesign --verify --deep --strict can accept ad-hoc signatures, so keychain certificate presence plus an embedded requirement is not alone a positive CMS-signature proof.

Once root signing explicitly sets --identifier dev.propr.desktop, require exactly one emitted Identifier=dev.propr.desktop line and exactly one positive Signature size=[1-9][0-9]* line, while continuing to reject any Signature=adhoc line. Do not retain optional/empty identifier or signature acceptance. Add negative tests for empty details, missing signature size, zero size, duplicate/conflicting size, missing/duplicate/conflicting identifier, and ad-hoc; keep format-tolerant whitespace/case only where codesign actually varies. Preserve exact keychain SHA, exact leaf DR, strict/stable verification, and journey evidence.

Also fix the remaining README wording in the same follow-up: it still says root + leaf, but implementation now generates one self-signed CA:false code-signing leaf. No additional behavioral scope.

✅ Applied the requested follow-up changes in commit 7704927

Summary of Changes

Implemented the PR #2108 follow-up without committing.

• Enforced exactly one Identifier=dev.propr.desktop and one positive numeric Signature size, with fixed SIGNATURE_METADATA_FAILURE diagnostics while retaining ad-hoc rejection in verify-darwin-packaged-connect-signature.mjs.
• Added all requested negative regressions in verify-darwin-packaged-connect-signature.test.mjs.
• Corrected the self-signed CA:false leaf wording in README.md.

Validation:

• Full desktop suite: 463 passed, 25 platform-specific skipped.
• Focused signing/verifier suite: 33/33 passed.
• Syntax, ESLint, and git diff --check passed.
• Native macOS execution was unavailable on this Linux worker.
• No visual preview created because the change is CI/documentation-only.

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 6m 34s
• Tokens: 1,868,627 (1,857,620 in / 11,007 out)
• Cost: $1.74

Undo Changes • View Task Execution

_{🤖 Generated by ProPR}
Processing comment ID: 5543908141✓

/review

✅ AI Code Review Complete requested by @integry

Posted 1 review:

• codex:gpt-5.6-sol

View Task Details

🔍 AI Code Review — codex:gpt-5.6-sol

Overall Evaluation

This PR implements a carefully bounded Darwin-only signing harness that verifies persistent Electron Safe Storage identity across pair and reprobe launches. No PR-scoped code blocker is evident, but the PR is not ready to merge while both authoritative Windows package-validation checks are failing and several checks remain pending.

✅ Strong signing proof — The verifier requires the exact keychain SHA-1, root identifier, positive CMS signature size, certificate-bound designated requirement, strict deep verification, and stable requirement evidence.

✅ Robust process cleanup — The bounded supervisor retains its process-group guard through failure and SIGKILL escalation, with regressions covering TERM-ignoring descendants.

✅ Native acceptance succeeds — Packaged Connect passes on both Darwin ARM64 and x64 while exercising the real os-protected backend without credential pre-seeding or trust mutation.

Merge blockers

No merge blockers.

Suggestions

These are optional follow-ups and are not sent to /fix.

No suggestions.

Score

The implementation appears correct and well tested within scope, but unresolved current-head Windows validation failures prevent merge readiness despite the successful Darwin acceptance lanes.

Score: 7/10

🤖 Review Details

• Model: GPT-5.6 Sol
• Time: 2m 21s
• Tokens: 80,906 (73,942 in / 6,964 out)
• Cost: $0.53

View Task

💡 Next step: Comment /fix to address F# merge blockers only.
F# IDs increment across review comments and remain permanent, so selectors such as /fix F3 F5 stay unambiguous across cycles. Suggestions require a separate ordinary follow-up request.

_{🤖 Review by ProPR}