build: sign macOS server releases and refresh dependencies

[steipete]

Make every macOS release artifact use the Foundation Developer ID and require notarization before publication. The existing GoReleaser server archives had ad-hoc signatures; the desktop app was already signed. The local signed-tag macOS packaging command now also builds and signs both server architectures, submits them to Apple, and records checksums and submission receipts. GoReleaser excludes Darwin to preserve those draft assets. A clean macOS runner verifies the Foundation identity, hardened runtime, explicit notarization requirement, architecture, and macOS 13 server minimum. The desktop minimum remains macOS 12.

This also refreshes SQLite to 1.60.0, Virtua to 0.52.8, Wrangler to 4.143.0, oxfmt to 0.71.0, and oxlint to 1.86.0, rebuilds embedded web assets, and prepares the 0.7.0 changelog for the roaming feature in #260. The dependency cooldown and runtime floors remain intact. Every existing changelog bullet is preserved, with an empty Unreleased section above 0.7.0.

Validation:

• pnpm check, pnpm coverage (86.7%), and 44 focused channel-order/chat Playwright tests passed on the dependency update.
• The release correction passed a fresh remote pnpm check, shell syntax checks, and goreleaser check.
• GoReleaser's snapshot build succeeded for all eight original server targets before moving the Darwin builds into the signing workflow.
• A real Foundation-signed but unnotarized CLI passes signature verification and is rejected by codesign --check-notarization -R=notarized.
• Independent P0–P2 reviews are clean after correcting the explicit notarization requirement.

Final signed artifacts will be built from the release tag and verified again locally and on the clean macOS runner. Publication remains gated on that verification.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 1, 2026, 12:06 AM ET / 04:06 UTC (Revision 2).

ClawSweeper review

What this changes

The branch adds signed and notarized macOS server packaging and publication checks, updates five dependencies and embedded browser assets, and prepares the 0.7.0 changelog.

Merge readiness

✅ Ready for maintainer review

The release correction remains useful: current main still builds Darwin server archives through GoReleaser without this signing path. No concrete introduced defect was found, and the repository-state MEMBER classification also prevents automatic closure.

Likely related people: steipete, with high-confidence routing from prior release work.

Priority: P2
Reviewed head: 0f895bf50a53858233d96482acc185d342387870

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A coherent release correction with reported validation and no supported blocking defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: Repository State identifies MEMBER authorship, exempting ordinary contributor proof. The body reports a real signed-but-unnotarized CLI rejection, while complete two-architecture packaging remains release-tag validation enforced before publication. No stored-data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Repository State identifies MEMBER authorship, exempting ordinary contributor proof. The body reports a real signed-but-unnotarized CLI rejection, while complete two-architecture packaging remains release-tag validation enforced before publication. No stored-data contract changes.
Evidence reviewed	7 items	Pinned introduction and current-main boundary: Read the introduced source changes between the pinned main and head. Main includes Darwin in GoReleaser; the branch removes that target and adds a distinct signed server packaging path. The raw head parent matches the supplied original-head record. Signing and verification boundary: The server packager validates a clean signed tag, builds both architectures, signs with the existing Foundation identity and hardened runtime, requires accepted notarization, and records archive hashes and receipts. The verifier checks the Foundation requirement, notarization, architecture, and macOS minimum before executing the native binary's version command. Publication remains gated: The workflow downloads the new server assets and invokes the combined macOS verifier. Public release publication depends on successful macOS verification; no Action ref, token scope, or publication permission is broadened by the introduced patch.
Findings	None	None.
Security	None	None.

How this fits together

ClickClack's release pipeline turns tagged server and desktop source into downloadable installers and archives. Local macOS signing produces draft assets that a clean GitHub runner verifies before the release becomes public.

flowchart TD
  A[Signed release tag] --> B[Local macOS packaging]
  B --> C[Foundation signing]
  C --> D[Apple notarization]
  D --> E[Draft release assets]
  E --> F[Clean runner verification]
  F --> G[Public release]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Release-script LOC	production +199/-20, tests +0/-0	The growth implements two server architectures and their signing, notarization, receipt, and verification steps.

Technical review

Best possible solution:

Keep macOS server signing in the existing local release process and require the clean-runner verification to succeed before publication.

Do we have a high-confidence way to reproduce the issue?

Not applicable to a reproduced runtime bug: source inspection establishes the existing unsigned server-release path, but this read-only review did not execute macOS packaging.

Is this the best way to solve the issue?

Yes. Extending the existing Foundation signing process and preserving publication verification is a coherent solution; no concrete introduced defect was found.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning medium; reviewed against 975ee58c1fc7.

Labels

Label changes:

• add P2: This is a bounded release-integrity improvement with no demonstrated urgent user-facing regression.
• remove P3: Current review triage priority is P2, so this older priority label is no longer current.

Label justifications:

• P2: This is a bounded release-integrity improvement with no demonstrated urgent user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Repository State identifies MEMBER authorship, exempting ordinary contributor proof. The body reports a real signed-but-unnotarized CLI rejection, while complete two-architecture packaging remains release-tag validation enforced before publication. No stored-data contract changes.

Evidence

What I checked:

• Pinned introduction and current-main boundary: Read the introduced source changes between the pinned main and head. Main includes Darwin in GoReleaser; the branch removes that target and adds a distinct signed server packaging path. The raw head parent matches the supplied original-head record. (.goreleaser.yml:15, 0f895bf50a53)
• Signing and verification boundary: The server packager validates a clean signed tag, builds both architectures, signs with the existing Foundation identity and hardened runtime, requires accepted notarization, and records archive hashes and receipts. The verifier checks the Foundation requirement, notarization, architecture, and macOS minimum before executing the native binary's version command. (apps/desktop/scripts/verify-macos-server-release.sh:32, 0f895bf50a53)
• Publication remains gated: The workflow downloads the new server assets and invokes the combined macOS verifier. Public release publication depends on successful macOS verification; no Action ref, token scope, or publication permission is broadened by the introduced patch. (.github/workflows/release.yml:201, 0f895bf50a53)
• Validation and proof scope: The captured PR body reports checks, coverage, focused browser tests, release configuration checks, and rejection of a real Foundation-signed but unnotarized CLI. It explicitly defers final signed archives to the release tag. The downloaded screenshots were inspected and show the related roaming-channel-order change from feat(web): roam the personal channel order with the account #260; they do not demonstrate this server packaging path. Repository State identifies this PR as MEMBER-authored, so ordinary external-contributor proof is exempt. (0f895bf50a53)
• Dependencies and persisted-state scope: Manifest and lockfile changes match the stated dependency refresh. The existing 48-hour release-age gate and runtime declarations remain intact. No schema, migration, serialized-state contract, dependency source override, or new lifecycle hook is introduced. (pnpm-workspace.yaml:23, 0f895bf50a53)
• Feature-history routing: Available source history connects the existing Foundation-scoped macOS release command to commit 146f762, and subsequent release/dependency work repeatedly involves Peter Steinberger. The commit's raw recorded parent and added-file patch were inspected. Some deeper history traversal failed with a promisor-remote HTTP 403; routing uses the available verified history. (apps/desktop/scripts/package-macos-release.sh:7, 146f76255bcc)

Likely related people:

• Peter Steinberger: Raw commit 146f762 adds apps/desktop/scripts/package-macos-release.sh:7 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 146f76255bcc; files: apps/desktop/scripts/package-macos-release.sh)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-10-01T03:26:40.740Z sha 2533d78 :: needs maintainer review before merge. :: none