[schonarth]

Summary

Apps cannot currently add separate items to Copy's Paste Stack. Add an opt-in, versioned batch interface and a Shortcuts action that accept text items, preserve their order and duplicates, and activate Paste Stack in FIFO mode. Replacing a nonempty stack always requires confirmation.

External access is off by default. Settings > Permissions lets the user enable it, review and revoke remembered callers, or explicitly add an unsafe developer exception tied to an app's bundle identifier and path. Remembered permissions and the opt-in are held in Copy's data-protection Keychain group; inaccessible protected storage fails closed. A disabled installation does not read that Keychain item for incoming requests.

The Apple-event interface derives the sender from the actual audit token; a capability handshake contains no user text. The App Intent uses the same validation and stack operation but cannot establish an originating app, so it requests approval every time. Batch requests are bounded and expire; stack changes while a confirmation is open require another confirmation.

Validation completed

• CopyCore suite: 258 tests passed.
• Unsigned Copy app build and 10 app tests passed.
• Apple-event proof on macOS 26 used isolated test apps and data. It did not validate the final signed Keychain or release configuration.
• git diff --check, release-script shell syntax, and dependency pin checks passed.

Owner validation required before merge

This is a draft: the signing and security paths have not been verified with the owner's Apple-issued credentials. Please do not merge or release until these steps pass:

1. Create or select a Developer ID provisioning profile authorizing Copy's app identifier and Keychain access group. Configure COPY_PROVISIONING_PROFILE_BASE64 for release CI, or install the profile locally and set COPY_PROVISIONING_PROFILE to its UUID as described in docs/paste-stack-integration.md. Do not share private signing keys.
2. Build, sign, and notarize a test build using the intended release workflow. Confirm the exported app retains its entitlements and embedded profile, and the signed app launches and can securely read and write its own data-protection Keychain group.
3. On macOS 14 and a current macOS release, check that external requests are disabled by default and do not trigger Keychain authorization; explicitly enable them and verify opt-in, deny, allow once, remember, revoke, and developer-exception flows.
4. Verify separately signed callers, incorrect or spoofed identities, authorization revocation during a confirmation, malformed and oversized requests, expired requests, and existing-stack replacement. Confirm rejected requests leave the stack unchanged.
5. Run the cross-app flow against Toptal Screener PR #112, verifying distinct entries, duplicates, FIFO order, and no private payload sent to an unverified Copy process. Also verify Shortcuts requests always receive one-time confirmation.

Unsigned or self-signed local tests cannot prove the Keychain group, shipping signature, or profile configuration. The owner should inspect the release pipeline and its new profile secret before enabling it.