[dannydover]

Scope

Prepare Kin 1.3.0 build 7 and a manually dispatched, approval-gated Kin Dev signing-only trial. Upload mode is rejected and the upload step remains disabled. The existing production signing proposal remains disabled. This draft does not sign, upload, release, or configure credentials; CI uses synthetic fixtures and fake tools.

Review blockers before any real trial

• Confirm the existing kin-dev-signing environment and its main-only, required-reviewer, and no-admin-bypass protections remain configured. The workflow does not currently fail closed if the environment is deleted and auto-created without protections; similarly named higher-scope secrets could fall back. Resolve this before enabling a real trial.
• Verify a credential-bearing job will use a GitHub-hosted isolated runner; xcode-27 alone is not proof. Review the distribution key's team-wide signing risk, process-argument password exposure, and cleanup limitations after runner loss or SIGKILL.
• Verify the P12 private key matches the reviewed distribution certificate and Dev profile. Real Xcode signing, export, entitlement compatibility, and Apple processing are untested. A signing-only run deletes its IPA and cannot provide an installable build.
• Build 7 is provisional and not reserved. Recheck Apple records before any upload. Kin Dev testing is separate from production signed-Release and upgrade validation.

A protected-environment setup, user-direct secret entry, signed trial, upload/TestFlight distribution, App Review and release each require their own applicable approval. No secret values belong in this PR or logs. Earlier Friend/Save and simulator cleanup failures remain unresolved.

Validation

Local reconstructed suite: 146 script tests passed, including four fake-tool Dev signing/cleanup cases; indexed repository privacy guard, project lint, YAML/shell syntax and patch dry run passed. Hosted credential-free PR CI will run automatically. Real signing and Apple behavior are not established by these tests.