Ship trusted clean-machine macOS distribution

[robinbraemer]

Outcome

Distribute the supported macOS application as a reproducible, signed, notarized, installable, updatable, and removable product whose public executable and private runtime match the verified release artifacts.

Product-quality coverage

FQ-01.1, FQ-01.6, FQ-20.2, FQ-22.2, FQ-22.3, and FQ-24.8.

Required behavior

• Produce deterministic release inputs and record the exact source, lockfile, Rust, Bun, Tauri, and media toolchain.
• Sign with the approved Developer ID, enable reviewed hardened-runtime and App Sandbox settings where compatible with required behavior, and notarize/staple the release.
• Preserve one public flect executable and one private flect-runtime implementation inside the bundle.
• Verify DMG, checksum, signature, notarization, architecture, bundle contents, update behavior, shell-link ownership, and uninstall cleanup.
• Keep browser/source installation independent from proprietary release infrastructure.

Acceptance criteria

• A clean supported Apple Silicon machine downloads, verifies, installs, launches, authenticates, completes the public-beta loop, updates, and uninstalls without quarantine workarounds or terminal login.
• Independent rebuild evidence documents any unavoidable nondeterministic signing envelope while proving identical unsigned application content.
• codesign --verify --deep --strict, Gatekeeper assessment, notarization validation, stapling validation, DMG checksum, and executable inventory all pass.
• Update preserves user work, grants, extensions, and rollback state according to their contracts; uninstall removes only Flect-owned application and optional shell-link state.
• README and release notes name exact supported macOS and architecture boundaries and do not advertise absent hosts.

Non-goals

• Storing Apple or provider credentials in the repository.
• Overwriting foreign shell links or user workspaces.
• Claiming Windows, Linux, Intel, iOS, or Android distribution from this issue.

[robinbraemer]

Local development-distribution evidence is now implemented and recorded in docs/verification/2026-08-01-distribution-verification.md.

Proven locally:

• bun run release:package builds the app/private runtime and stages DMG, checksum, demo MP4, and deterministic evidence-manifest structure.
• The gate validates exact version/layout, rejects companion executables, requires both binaries to be arm64, verifies the checksum from its artifact directory, verifies the DMG, mounts it read-only, and runs codesign --verify --deep --strict on the mounted app.
• The development app is valid ad-hoc hardened-runtime signed; the manifest honestly records Gatekeeper false and stapled false.
• The final DMG was installed to /Applications/Flect.app, opened as the only Flect instance, spawned its one private flect-runtime child, and its installed public executable returned the AXI help catalog.
• Public mode now fails closed on dirty/wrong tag, unverified reproducibility, non-Developer-ID signing, missing Team ID, missing hardened runtime, Gatekeeper rejection, or missing stapling.

Reproducibility investigation:

• Two normalized unsigned builds differed.
• Bundle metadata and the private Bun runtime matched; the public Tauri executable differed by 83 bytes.
• Vendored source and binary inspection tied the difference to fresh Tauri Isolation Pattern schema/transport/AES-GCM material and the derived Mach-O UUID.
• Those are functional security bytes, so the verifier does not mask them. The manifest records tauri-isolation-per-build-randomness, and public release proof remains failed closed.

This issue remains open. Still required: an independently reviewed reproducible-isolation strategy, Developer ID Application identity, notarization/stapling, Gatekeeper acceptance, independent clean-machine install, update preservation, uninstall proof, and App Sandbox/helper entitlement review.

[robinbraemer]

Native update and ownership-safe uninstall evidence (2026-08-03):

• Effect contracts, guarded single-use update candidates, the Tauri main-window-only updater adapter, explicit browser/development unavailable states, protected Diagnostics controls, ownership-aware uninstall planning/preparation, built-in flect AXI commands, signed updater manifest verification, and exact unsigned-tree comparison are implemented in the current PR worktree.
• Final gates: bun run check passed 153 test files plus 1 skipped, 828 tests plus 1 skipped; full production Chromium passed 79/79 in 3.8m after the final native CLI composition fix; native update repeat passed 6/6; cargo fmt passed; Rust passed 25/25; git diff --check passed.
• Installed dogfood: /Applications/Flect.app is byte-identical to the final source bundle for both executables; SHA-256 flect 785327f970783103fbc938a29234b7fc7f712d673d2281bf919529952550d353 and runtime d135c02be40e50c40e490dd1fdfe91c8144024d42e6231004a8fb1682b1612dd. Deep/strict code-sign verification passes. One app process, one private runtime, one normal window, Pi ready, Local control off, and no control descriptor were observed.
• Uninstall dogfood removed only a Flect-owned shell link and Codex hook. Foreign Claude/OpenCode files, workspace data, and an export remained byte-identical. The installed public command returns the bounded uninstall plan.
• Exact reproducibility remains false: tree hashes 4b46f15cdc7cb2b1f38ff8ba3455595da8dee1ed54bfa6198c02c1db4381b045 and 3a34a2c2969f615d45c0d282035bf9c8f8eb1b2e37e742dcb20048f7da256a8 differ only at Contents/MacOS/flect because of Tauri Isolation per-build security material.

This is not public-release proof. The real signed older-to-newer fixture update, Developer ID Application signing, notarization, Gatekeeper acceptance, stapling, clean-machine verification, and a reviewed reproducibility resolution remain open. No commit, push, release, updater artifact publication, merge, or issue close occurred.

[robinbraemer]

Follow-up evidence: the task-scoped signed fixture-update criterion is now complete.

A new Effect-owned dogfood harness creates a genuine 0.1.0 Flect fixture, a real 0.2.0 app tarball, and an ephemeral Ed25519/Minisign updater key. A loopback-only test adapter serves the manifest and archive, the guarded update service installs it, and the exact staged app entrypoint executes as 0.2.0. Workspace, settings, grants, and extension canaries remain byte-identical.

The negative path stages a separately signed 0.3.0 archive, deliberately corrupts its signature, and proves the update is rejected before replacement. The installed app-tree digest and every durable canary digest remain unchanged. Focused release/package/comparison/update dogfood is 16/16 green; release:verify is 13/13 green.

Issue #23 remains open because this does not replace Developer ID signing, notarization, Gatekeeper acceptance, stapling, clean-machine verification, an update between real public builds, or resolution of Tauri Isolation per-build reproducibility variance.

[robinbraemer]

Pushed verification update — 2026-08-10

The optimized Apple Silicon Flect.app builds with the private runtime in Contents/MacOS and passes deep/strict ad-hoc signature verification. A random-ID isolated copy launches through the real macOS host, exposes standard menus and three native window controls, enforces the 760 × 560 minimum size, survives sidecar failure, and relaunches cleanly.

Evidence: packaged macOS verification. Developer ID signing, notarization, hardened-runtime distribution review, and clean-machine Gatekeeper launch still require release credentials and external hardware.