Release authority blockers prevent mass-production readiness

[rogu3bear]

Summary

Cursor Designer's local app and artifact gates are mostly green, but the app is not mass-production ready because the public release authority gates are blocked on Apple notarization credentials, Gatekeeper acceptance, stable GitHub release metadata, and manual release evidence.

This issue intentionally tracks the external release-authority work. It should not be closed from tests alone.

Fresh evidence

Repository state when filed:

• branch: main
• HEAD: 91f14f5
• local tree: clean against origin/main
• open PRs: none

Passing local app proof from the current audit:

• ./scripts/check-monorepo-references.sh
• ./scripts/check-website-boundary.sh
• ./scripts/check-distribution-boundary.sh
• ./scripts/check-compatibility-boundary.sh
• ./scripts/check-local-first.sh
• ./scripts/check-app-ui-contract.sh
• swift test --package-path apps/macos: 201 tests, 0 failures
• make -C apps/macos preflight
• make -C apps/macos launch-smoke
• make -C apps/macos dmg
• make -C apps/macos dmg-install-check
• make -C apps/macos dmg-artifact-match-check
• make -C apps/macos signed-dmg

Current signed local artifact:

• path: apps/macos/CursorDesigner.dmg
• SHA-256: b69d869d5356d0b0c9390b5b4bf0be3aea421ad7ac05d84ef586f6a7dfdb852b
• app version: 1.0.0
• app build: 1

Failing release-authority proof:

• make -C apps/macos release-artifact-readiness NOTARY_PROFILE="notarization"
• make -C apps/macos north-star-audit NOTARY_PROFILE="notarization"

Observed blockers:

• Gatekeeper rejects app: source=Unnotarized Developer ID
• Gatekeeper rejects DMG: source=Insufficient Context
• stapler reports CursorDesigner.dmg does not have a stapled ticket
• notarytool reports no Keychain password item found for profile: notarization
• gh release list shows only prerelease v0.8-unstable-alpha; there is no stable public release metadata

Required closure

Close this only after all of the following pass against the same candidate DMG:

• make -C apps/macos notary-profile-check NOTARY_PROFILE=""
• make -C apps/macos release-candidate SIGN_IDENTITY="" NOTARY_PROFILE=""
• make -C apps/macos release-readiness NOTARY_PROFILE=""
• make -C apps/macos manual-release-evidence-check MANUAL_EVIDENCE=""
• make -C apps/macos north-star-audit NOTARY_PROFILE="" MANUAL_EVIDENCE=""

Manual evidence must come from apps/macos/MANUAL_RELEASE_CHECKS.md and must match the same Gatekeeper-accepted DMG by commit, release tag, DMG filename, DMG SHA-256, mounted app bundle ID, app version, app build, and executable SHA-256.

Non-goals

• Do not create or publish a website to work around this.
• Do not add Homebrew/stable download claims before the release metadata and manual evidence pass.
• Do not mark mass-production readiness from the automated Swift test suite alone.

[rogu3bear]

Current status update as of main babda4b:

Landed app/release-proof hardening since this issue was filed:

• hygiene(pointer): ignore release evidence outputs #72 ignored generated apps/macos/ReleaseEvidence/ and apps/macos/notarization-output/ so local evidence/notary output is not accidentally committed.
• ci(pointer): scan all docs for premature distribution claims #73 broadened the distribution boundary guard to scan all markdown docs for premature stable download/Homebrew claims.
• ci(pointer): block remote package and endpoint drift #74 strengthened the local-first guard against remote SwiftPM package URLs, hardcoded HTTP endpoints, and TelemetryDeck drift in app/package surfaces.
• proof(pointer): require release tag for manual evidence template #75 made manual-release-evidence-template fail early when RELEASE_TAG is omitted.
• proof(pointer): bind evidence template tag to app version #76 made manual-release-evidence-template reject a tag that does not match the mounted app version.

Still blocked for mass-production readiness:

• no usable notarytool profile for the release lane
• app/DMG still require notarization and stapling
• Gatekeeper acceptance still needs proof against the same candidate DMG
• no stable GitHub release metadata matching app version and DMG digest
• completed manual evidence still cannot be produced until the same Gatekeeper-accepted DMG exists

Cost boundary: no additional hosted CI lanes are being proposed here; closure remains the existing release-authority proof path in the issue body.

[rogu3bear]

Local uncommitted tranche update from main at babda4b:

Additional local hardening now present in the working tree:

• NORTH_STAR.md, README.md, ANCHOR.md, AGENTS.md, and CLAUDE.md now align around the app-first pointer product, cheap hosted CI, no canonical website yet, and no mass-production claim without release-authority proof.
• Permission posture persistence is wired in the app settings/controller path for last-known Screen Recording and Accessibility state, with live macOS permission checks remaining authoritative.
• Hosted CI has been kept cheap: root product/boundary smoke only, with macOS package/signing/notarization proof remaining local.
• Manual release evidence now binds to release tag, commit, DMG digest, mounted app identity, app version/build, executable digest, and rejects unfilled or mismatched evidence.
• Root website guidance now explicitly treats the Leptos Cloudflare template as a future technical base only, not permission to scaffold a generic SaaS/placeholder/download surface.

Fresh local proof from this tranche:

• swift test --package-path apps/macos: 203 tests, 0 failures
• root guardrails all pass: product boundary, website boundary, distribution boundary, compatibility boundary, local-first, app UI contract
• make -C apps/macos preflight passed after a clean package rebuild
• make -C apps/macos signed-dmg SIGN_IDENTITY="Developer ID Application: MLNavigator Inc. (4JB58L7BTZ)" passed
• make -C apps/macos dmg-artifact-match-check REQUIRE_SIGNATURE=1 passed
• make -C apps/macos manual-release-evidence-template RELEASE_TAG=v1.0.0 generated artifact-bound evidence fields
• a mismatched evidence tag (v0.9.0) is rejected because the mounted app version is 1.0.0

Current local signed DMG:

• path: apps/macos/CursorDesigner.dmg
• SHA-256: de782fbee3eee315678ed28b747b504683ac236f59e196c0272403709ae8e904
• app executable SHA-256 from evidence template: 6823e613cd7a4fdb5db168c80402fe119f87f094deb9ec1d190069d2e1e02f94

Still blocked, unchanged:

• notarytool profile notarization is not available in Keychain
• app is rejected by Gatekeeper as source=Unnotarized Developer ID
• DMG is rejected by Gatekeeper as source=Insufficient Context
• DMG has no stapled notarization ticket
• no stable public GitHub release metadata exists; only prerelease v0.8-unstable-alpha is present
• manual release evidence cannot be completed until the same Gatekeeper-accepted DMG exists

Do not close this issue from the local green checks above; close only after the release-authority gates in the issue body pass against the same notarized/stapled/Gatekeeper-accepted DMG.

[rogu3bear]

Follow-up from the same local main tranche at babda4b:

The local release-authority lane now has a first-class credential setup step instead of only prose:

• apps/macos/Scripts/setup-notary-profile.sh creates/verifies a notarytool Keychain profile from private NOTARY_* inputs, supporting App Store Connect API key auth or Apple ID/app-specific-password auth.
• make setup-notary-profile NOTARY_PROFILE=<profile> is wired into apps/macos/Makefile, RELEASE_RUNBOOK.md, REQUIREMENTS.md, and the North Star prompt-to-artifact checklist.
• notary-profile-check and release-readiness now point operators to that repo target when the profile is missing.

Fresh local audit evidence:

• make -C apps/macos north-star-audit NOTARY_PROFILE=notarization still correctly reports not mass-production ready.
• Passing portions: product boundary, website boundary, distribution boundary, compatibility boundary, local-first check, app UI contract, swift test (203 tests, 0 failures), app launch smoke, code signature verification, hardened runtime check, DMG install/mounted-app match, and DMG signature verification.
• Remaining blockers are unchanged in class: Gatekeeper rejects the app as Unnotarized Developer ID, Gatekeeper rejects the DMG as Insufficient Context, the DMG has no stapled ticket, no Keychain profile exists for notarization, and there is no stable GitHub release matching the current app/DMG.

Do not close this issue from local green tests alone. It closes only after a valid notary profile is created, the signed DMG is notarized and stapled, Gatekeeper accepts both app and DMG, stable release metadata matches the app version and DMG digest, and manual release evidence is completed against that same accepted artifact.

[rogu3bear]

Final local proof update for the current uncommitted tranche on main at babda4b:

The repo-local release doctrine is now aligned end to end:

• NORTH_STAR.md, root README.md, ANCHOR.md, AGENTS.md, CLAUDE.md, apps/macos/README.md, apps/macos/REQUIREMENTS.md, and apps/macos/RELEASE_RUNBOOK.md all route release authority through the same sequence: make setup-notary-profile, make notary-profile-check, make release-candidate, make release-artifact-readiness, and make release-readiness.
• The new apps/macos/Scripts/setup-notary-profile.sh supports private NOTARY_* API-key or Apple ID credential setup, keeps issuer optional for individual API keys and required for team API keys, and is pinned by local tests.
• The working tree now includes tests that pin executable release scripts, release authority docs, cheap CI, no website scaffold, no premature distribution copy, and permission posture persistence.

Fresh local verification after the final doc/script/test updates:

• swift test --package-path apps/macos: 205 tests, 0 failures.
• Root guardrails passed: product boundary, website boundary, distribution boundary, compatibility boundary, local-first app surface, and app UI contract.
• git diff --check: passed.

This still does not close the issue. make -C apps/macos notary-profile-check still fails because no Keychain profile exists for notarization, and the North Star mass-production bar still requires the signed DMG to be notarized, stapled, Gatekeeper-accepted, matched by stable release metadata, and backed by completed manual release evidence.

[rogu3bear]

Additional local proof-quality hardening from the same uncommitted main tranche at babda4b:

• NORTH_STAR.md now defines the operator's "99% sure this product is ready to use for mass production" bar as: final North Star audit, public release readiness, and artifact-bound manual release evidence all passing against the same signed, notarized, stapled, Gatekeeper-accepted DMG.
• manual-release-evidence-check.sh now rejects soft non-proof values such as pending, N/A, untested, incomplete, not verified, and not applicable in the observed release checks.
• release-readiness.sh now captures each check's combined output and prints it under that check before PASS/FAIL, so release receipts do not interleave failure output with the next heading.
• Local tests pin these proof-quality behaviors in IdentityTests.

Fresh local verification after those changes:

• swift test --package-path apps/macos: 205 tests, 0 failures
• git diff --check: passed
• bash -n over the release/notary/evidence scripts: passed
• make -C apps/macos release-readiness NOTARY_PROFILE=notarization: still fails only on the expected external release-authority blockers, with clearer ordered output
• make -C apps/macos north-star-audit NOTARY_PROFILE=notarization: local/product gates pass, then correctly reports not mass-production ready

Still not closable:

• no valid notarization Keychain profile
• app rejected by Gatekeeper as Unnotarized Developer ID
• DMG rejected by Gatekeeper as Insufficient Context
• no stapled notarization ticket
• no stable GitHub release matching this app/DMG artifact
• no completed manual release evidence against a Gatekeeper-accepted DMG

[rogu3bear]

Additional local update from the same uncommitted main tranche at babda4b:\n\n- Permission persistence is now visible as a Preferences diagnostics line: Last checked: Screen Recording ...; Accessibility ..., explicitly followed by Live macOS permission checks decide features. Stored permission posture remains continuity-only and does not grant behavior.\n- CursorStateController now exposes a tested permissionContinuitySummary fed by the persisted last-known Screen Recording and Accessibility posture.\n- check-app-ui-contract.sh pins the visible permission diagnostics text while staying cheap and portable with rg or grep.\n\nFresh local verification after this final permission-diagnostics slice:\n- swift test --package-path apps/macos: 207 tests, 0 failures\n- root guardrails passed: product boundary, website boundary, distribution boundary, compatibility boundary, local-first app surface, and app UI contract\n- bash -n over touched release/notary/evidence/guard scripts: passed\n- shellcheck over touched scripts: passed\n- git diff --check: passed\n- make -C apps/macos release-readiness NOTARY_PROFILE=notarization: still fails on expected external release-authority blockers\n- make -C apps/macos north-star-audit NOTARY_PROFILE=notarization: local/product gates pass, then correctly reports not mass-production ready\n\nIssue remains open for the same blockers: no valid notarization Keychain profile, app/DMG Gatekeeper rejection pending notarization, no stapled ticket, no stable release metadata matching the artifact, and no completed manual release evidence against a Gatekeeper-accepted DMG.

[rogu3bear]

Additional local hardening from the same uncommitted main tranche at babda4b:\n\n- scripts/check-website-boundary.sh now verifies the anti-vibe website doctrine, not only the absence of apps/website: it pins the no generic SaaS scaffold rule, keeps the Leptos Cloudflare template as a technical base only, and requires the North Star anti-placeholder/fake-testimonial standard to remain present.\n- IdentityTests.testWebsiteBoundaryGuardPreventsPrematureWebsiteSurface now pins those guard requirements.\n\nFresh local verification after this guard tightening:\n- swift test --package-path apps/macos: 207 tests, 0 failures\n- root guardrails passed: product boundary, website boundary, distribution boundary, compatibility boundary, local-first app surface, and app UI contract\n- bash -n over touched release/notary/evidence/guard scripts: passed\n- shellcheck over touched scripts: passed\n- git diff --check: passed\n- make -C apps/macos release-readiness NOTARY_PROFILE=notarization: still fails on the expected external release-authority blockers\n- make -C apps/macos north-star-audit NOTARY_PROFILE=notarization: local/product gates pass, then correctly reports not mass-production ready\n\nIssue remains open until the notary profile, notarization/stapling, Gatekeeper acceptance, stable release metadata, and artifact-bound manual evidence all pass against the same DMG.

[rogu3bear]

Additional local doctrine/guard update from the same uncommitted main tranche at babda4b:\n\n- NORTH_STAR.md and root README.md now spell out the allowed future Leptos/Cloudflare template capabilities without scaffolding a website: static-first Leptos UI, Cloudflare edge delivery, verified release metadata reads, digest display, compatibility notes, and privacy-preserving download routing.\n- The same doctrine explicitly rejects accounts, dashboards, analytics, server-side personalization, and background jobs just because the template can support them.\n- scripts/check-website-boundary.sh and IdentityTests now pin that capability boundary along with the no-generic-SaaS/no-placeholder website standard.\n\nFresh local verification after this update:\n- swift test --package-path apps/macos: 207 tests, 0 failures\n- root guardrails passed: product boundary, website boundary, distribution boundary, compatibility boundary, local-first app surface, and app UI contract\n- bash -n over touched release/notary/evidence/guard scripts: passed\n- shellcheck over touched scripts: passed\n- git diff --check: passed\n- make -C apps/macos release-readiness NOTARY_PROFILE=notarization: still fails on expected external release-authority blockers\n- make -C apps/macos north-star-audit NOTARY_PROFILE=notarization: local/product gates pass, then correctly reports not mass-production ready\n\nIssue remains open until the notary profile, notarization/stapling, Gatekeeper acceptance, stable release metadata, and artifact-bound manual evidence all pass against the same DMG.

[rogu3bear]

Additional local audit-receipt update from the same uncommitted main tranche at babda4b:\n\n- apps/macos/Scripts/north-star-audit.sh now carries the same future website tactic boundary in its prompt-to-artifact checklist: no canonical website exists, and any future Leptos/Cloudflare work is limited to static-first Leptos UI, Cloudflare edge delivery, verified release metadata reads, digest display, compatibility notes, and privacy-preserving download routing.\n- IdentityTests.testNorthStarAuditGateBuildsPromptToArtifactChecklist pins that audit receipt text, so the final readiness receipt cannot silently drop the no-vibe/verified-release website standard.\n\nFresh local verification after this update:\n- swift test --package-path apps/macos: 207 tests, 0 failures\n- root guardrails passed: product boundary, website boundary, distribution boundary, compatibility boundary, local-first app surface, and app UI contract\n- bash -n over touched release/notary/evidence/guard scripts: passed\n- shellcheck over touched scripts: passed\n- git diff --check: passed\n- make -C apps/macos release-readiness NOTARY_PROFILE=notarization: still fails on expected external release-authority blockers\n- make -C apps/macos north-star-audit NOTARY_PROFILE=notarization: local/product gates pass, the audit receipt includes the future website tactic boundary, then correctly reports not mass-production ready\n\nIssue remains open until the notary profile, notarization/stapling, Gatekeeper acceptance, stable release metadata, and artifact-bound manual evidence all pass against the same DMG.