build(desktop): qualify signed and notarized macOS packages #2109

Goal

Build on #2056 to deliver signed/notarized macOS packages and complete installed-app qualification on Apple Silicon and Intel.

Parent: #2099. First-wave delivery: #2099. Work item: F1-07.

PR breakdown

• PR 07-C — Installed local bootstrap and LaunchAgent qualification. Integrate the shared runtime/helper resources with the signed/notarized distribution and verify personal provisioning, user LaunchAgent behavior, repair, and removal on Apple Silicon and Intel. Keep common Installer/Ops logic in feat(installer): bootstrap a managed local PowerContext runtime #2115/feat(ops): expose structured personal Server lifecycle operations #2116 and platform-specific fixes here.

• PR 07-A — macOS signing and notarization. Integrate signing, notarization, and verification around the existing app/DMG builds. Coordinate version/artifact identity and credentials with the shared release path.

• PR 07-B — Dual-architecture installed qualification. Add reproducible installed-app acceptance procedures/evidence and fix remaining platform issues on Apple Silicon and Intel, covering the complete shared workflow.

Dependencies and coordination

• feat(installer): bootstrap a managed local PowerContext runtime #2115/feat(ops): expose structured personal Server lifecycle operations #2116/feat(desktop): guide local Server setup and lifecycle management #2117 supply bootstrap, structured OS operations, and setup UI. build(desktop): publish Desktop and local runtime installation artifacts #2112 produces versioned runtime/helper resources. Signing, notarization, architecture selection, stable runtime paths, and clean-machine resource installation must be agreed before final PR 07-C verification.

• feat(desktop): add macOS native preview support #2056 owns the macOS native baseline, Keychain, constrained diagnostics, packaged navigation, app/DMG builds, and existing qualification records. Reuse its accepted outputs rather than reimplementing them.

• Coordinate build/sign/notarize interfaces with build(desktop): publish Desktop and local runtime installation artifacts #2112. Signing infrastructure can proceed before final feature integration.

• Final acceptance depends on normal-product compatibility from feat(desktop): integrate Server discovery and operation compatibility #2101 and integrated feat(desktop): establish the shared application layout and navigation #2102, feat(desktop): complete the connection-to-Scope journey #2103, feat(desktop): complete Memory save, search, and exact-read journeys #2104, feat(desktop): visualize health and processing observations #2105, feat(desktop): visualize current-Scope inventory and usage #2106, and feat(desktop): summarize session requests and copy safe diagnostics #2107.

Acceptance criteria

• On clean network-connected standard-user machines of both architectures, provision the managed runtime without preinstalled Python, uv, Git, compiler tools, or terminal commands. All nested executable/helper/runtime distribution inputs meet the applicable macOS trust/signing/notarization requirements; developer verification bypasses do not count.

• Exercise actual per-user LaunchAgent registration, login behavior, reboot/login/reconnect, explicit stop/start/restart, and Desktop exit. Do not replace the OS manager with a GUI-owned child process; runtime paths must not disappear when the app moves or upgrades.

• Verify download/integrity failure, interrupted/repeated setup, foreign installations/port conflicts, damaged runtime, inspect/repair/remove, and config/data preservation. Desktop removal does not silently unregister/remove the Server or delete data.

• Complete first local save/search/exact-read/copy and observation without model configuration or manual tokens/Scope IDs. Record platform execution and runtime/helper digests separately for each architecture.

• Record supported macOS versions and both architectures. A named owner configures signing/notarization; the distributed package passes platform signature/notarization checks.

• Install/open the exact signed/notarized app/DMG intended for distribution under normal platform verification, without treating developer-only bypasses as release acceptance.

• On both architectures, exercise connection activation, exact Scope, save/search/exact-read/copy, and all three observation views against qualified Servers.

• Verify Keychain persistence, explicit session-only behavior, registered diagnostics and cleanup, clipboard paste-back, real IME, keyboard/focus, screen-reader behavior, and small-window/scaling usability.

• Verify the defined upgrade/removal behavior and preservation of the independently managed Server/data.

• Record source/package digests, Desktop/Server/OS/WebView identities, owner, steps, and results separately for each architecture. Compilation or one architecture's checks do not qualify the other.

• Supply the verified final artifacts to build(desktop): publish Desktop and local runtime installation artifacts #2112; building an unsigned DMG or uploading an Actions artifact does not complete this issue.

Delivery priority

Windows 11 x64 and macOS Apple Silicon/Intel are required for #2099. Linux #2110 and #2111 are optional, owner-driven work under #1428; missing Linux implementation, packaging, or qualification does not block this issue's first-wave acceptance or the Windows/macOS release. Any advertised Linux support requires its own actual qualification.

Non-goals

No duplicate shared Installer/Ops engine, Agent setup, automatic updates, or duplication of #2056's accepted native implementation. LaunchAgent setup and management consume #2116 and are verified here.

References and delivery rules

• Product scope and PR breakdown; static UI prototype. The prototype uses sample data, not production state logic.
• RFC docs(rfc): propose Tauri desktop control center #1455 and the Desktop delivery plan.
• Keep focused PRs independently reviewable and intermediate merges usable. An internal adapter may land before its page; do not expose incomplete features as operational. Close this issue only after its complete outcome is verified.
• Preserve the reviewed native transport, credential, public API, and context boundaries. Record actual backend/platform execution separately from mocks and CI-only fixtures.