fix: start the signed bundled OMP backend

[wolfiesch]

Outcome

Signed macOS builds can start the bundled OMP 17.0.5 backend and load its native module. Library validation is relaxed only for Contents/Resources/runtime/omp; the T4 Code app and Electron helpers retain the normal boundary.

Verification

• Reproduced v0.1.25 failure from the real launch-service log
• Temporary entitlement proof started a healthy isolated appserver
• Release inspector rejects v0.1.25 and verifies the narrow entitlement boundary
• pnpm build
• pnpm test:packaging
• pnpm check
• pnpm test

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4f7067de5b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

This PR updates the macOS signing/inspection pipeline so signed macOS builds can launch the bundled OMP 17.0.5 backend while keeping disable-library-validation scoped to Contents/Resources/runtime/omp, and then rolls the release forward to v0.1.26 with corresponding contract/test/documentation updates.

Changes:

• Add a custom macOS signing hook plus a dedicated entitlements plist for the bundled OMP runtime, and validate the “library validation boundary” during release inspection.
• Wire the signing hook into electron-builder and strengthen packaging/release tests to enforce the boundary.
• Bump version strings/URLs/release notes and update release-consistency fixtures and tests to 0.1.26.

Reviewed changes

Copilot reviewed 31 out of 32 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
SECURITY.md	Updates security policy text to reference v0.1.26 macOS signing/notarization.
scripts/sign-macos.mjs	Introduces a macOS signing hook that applies runtime-specific entitlements to the bundled OMP binary.
scripts/packaging.test.mjs	Asserts the signing hook is wired and that only the OMP runtime gets relaxed entitlements.
scripts/inspect-macos-release.test.mjs	Adds tests for validating the library-validation boundary between app and runtime entitlements.
scripts/inspect-macos-release.mjs	Extends release inspection to verify runtime signature and enforce entitlements boundary via codesign --entitlements.
scripts/check-release-consistency.test.mjs	Updates release-consistency expectations to v0.1.26.
README.md	Updates download links/version text and release notes section to v0.1.26 and the new macOS behavior description.
pnpm-lock.yaml	Adds @electron/osx-sign and updates lock snapshots.
packages/ui/package.json	Version bump to 0.1.26.
packages/service-manager/package.json	Version bump to 0.1.26.
packages/remote/package.json	Version bump to 0.1.26.
packages/protocol/test/fixtures/platform-boundaries.ts	Updates protocol fixtures to advertise latest version 0.1.26.
packages/protocol/package.json	Version bump to 0.1.26.
packages/fixture-server/package.json	Version bump to 0.1.26.
packages/client/src/omp-client-frames.ts	Updates client hello version to 0.1.26.
packages/client/package.json	Version bump to 0.1.26.
package.json	Root version bump to 0.1.26 and adds @electron/osx-sign dev dependency.
electron-builder.config.mjs	Wires the mac signing hook into the mac config when T4_MACOS_SIGNED_BUILD=1.
e2e/site-mobile-docs.spec.ts	Updates expected Android release URL to v0.1.26.
docs/CURRENT_RELEASE_NOTES.md	Updates current release notes to describe the v0.1.26 macOS runtime-start fix and boundary.
compat/omp-app-matrix.json	Updates desktop protocol version to 0.1.26.
apps/web/src/platform/browser-shell-port.ts	Updates browser client version string to 0.1.26.
apps/web/package.json	Version bump to 0.1.26.
apps/site/test/release.test.ts	Updates release asset contract tests to v0.1.26 filenames/tag/version.
apps/site/src/release.ts	Updates release tag/version and asset filenames to v0.1.26.
apps/site/package.json	Version bump to 0.1.26.
apps/mobile/package.json	Version bump to 0.1.26.
apps/mobile/capacitor.config.json	Updates appended user agent version to 0.1.26.
apps/desktop/src/target-manager.ts	Updates desktop client version string to 0.1.26.
apps/desktop/package.json	Version bump to 0.1.26.
apps/desktop/build/entitlements.omp-runtime.plist	Adds runtime-only entitlements enabling JIT/unsigned exec memory + disabling library validation for OMP.
.github/ISSUE_TEMPLATE/bug_report.yml	Updates bug report version placeholder to 0.1.26.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.