[SashaMIT]

Summary

Stack: #395 ← #397 ← #398 (cursor/intel-install-gate-1297, this PR's base) ← #399 (this).

Head: 39f53389. Draft. Do not merge.

prepare() and the release artifact prefix use one platform set, RELEASE_PLATFORMS, captured from COMPONENT_KEYS at import (scripts/release-signer.py:456). That set is x86_64-linux, aarch64-linux, and aarch64-darwin. x86_64-darwin stays outside it. prepare() checks it before verify_release_provenance (:1074-1077) and again on the parsed release (:1097).

A test adds x86_64-darwin to COMPONENT_KEYS after import. prepare() still raises release platforms refused before it fetches artifacts. The prefix release-x86_64-darwin is refused.

This pull request does not widen the production signer. A signed Intel download waits for a producer, a darwin-amd64 payload set, and a Home journey in one later change.

What this PR carries against its base: only b51bda59 (scripts/release-signer.py, scripts/release-signer-test.py, scripts/package-release-binaries-test.py; 3 files). Everything else comes from merges, never a rebase:

• 095084ff merged Stop Intel Mac before release lookup and pin the verified head CID #398 at 343da76a. Conflicts: scripts/release-signer.py kept this branch's RELEASE_PLATFORMS and early check and dropped the base's second allowlist (SIGNED_RELEASE_PLATFORMS), so the signer has one allowlist. scripts/package-release-binaries-test.py kept the base's packaging test and added one assertion: the release id that darwin-amd64 maps to is not in signer.RELEASE_PLATFORMS (:134).
• Later merges of Stop Intel Mac before release lookup and pin the verified head CID #398 (d40a2f5e, 3c5d3e16, e06de657) brought zip 9 (deps: move zip to 9.x for RUSTSEC-2026-0367/0368/0369 #417), the plain Intel stop and the held-lock journal test fix.
• 42b91fd8 merges Stop Intel Mac before release lookup and pin the verified head CID #398 at 51404a76, with no conflict. It brings Stop Intel Mac before release lookup and pin the verified head CID #398's fixes: the Intel stop is exactly Intel Mac is not supported yet., a Rosetta Terminal on Apple silicon installs aarch64-darwin, and install.sh uses only the bytes it checked (see Stop Intel Mac before release lookup and pin the verified head CID #398).
• bb874fe8 merges Stop Intel Mac before release lookup and pin the verified head CID #398 at 29733e73, with no conflict. It brings Define the launcher contract for gateway supervision #394's 36720070 through Smoke the gateway health probe on Intel Mac #395 and Name the Intel Mac release package darwin-amd64 #397: /healthz and the gateway start prove that the gateway holds the lock from the held flock, not the JSON record in host-process.lock (docs/LAUNCHER_CONTRACT.md, "What proves that this gateway holds the lock"). It also brings Smoke the gateway health probe on Intel Mac #395's macOS smoke test fixes.
• c647ecf7 merges Stop Intel Mac before release lookup and pin the verified head CID #398 at 112e168f, with no conflict. It brings Stop Intel Mac before release lookup and pin the verified head CID #398's round-4 commits: the swapped-Runtime test swaps the real download on macOS too (f8defe86), and install.sh runs the staged Runtime from one held file, not by path (112e168f; see Stop Intel Mac before release lookup and pin the verified head CID #398). This PR's 3-file diff against its base is unchanged.
• f4cf806a merges Stop Intel Mac before release lookup and pin the verified head CID #398 at 32f4abfd, with no conflict. It brings Define the launcher contract for gateway supervision #394's 4bb19dcf through Smoke the gateway health probe on Intel Mac #395, Name the Intel Mac release package darwin-amd64 #397 and Stop Intel Mac before release lookup and pin the verified head CID #398: the ownership proof is one step (each registry entry keeps a second descriptor of the locked open file, and the registry mutex is held from the lookup to the end of the probe; 85f3142e); the managed-runtime subordinate lane uses the same proof as /healthz, and a Home terminal gets an inherited lock descriptor, ELASTOS_GATEWAY_HOST_LOCK_FD (eed83a72); a held lock whose record cannot be read still counts as held (4bb19dcf). This PR's 3-file diff against its base is unchanged.
• 39f53389 merges Stop Intel Mac before release lookup and pin the verified head CID #398 at da63c235, with no conflict. It brings Stop Intel Mac before release lookup and pin the verified head CID #398's da63c235 (the swapped-Runtime test's Linux case mocks a GNU-like mktemp instead of using the host's, so it passes on a Mac host) and, through Name the Intel Mac release package darwin-amd64 #397 and Smoke the gateway health probe on Intel Mac #395, Define the launcher contract for gateway supervision #394's 13cdcad0 (the contract states that the host lock proves possession, not that the holder is the gateway) and Smoke the gateway health probe on Intel Mac #395's 630efc6d (the default-command smoke test no longer depends on port 8090). This PR's 3-file diff against its base is unchanged.

Tests

On 42b91fd8:

$ env -i PATH=$PATH HOME=$HOME python3 -I -S scripts/release-signer-test.py
Ran 88 tests in 2.479s
OK
$ env -i PATH=$PATH HOME=$HOME python3 scripts/release-platform-input-test.py
Ran 164 tests in 96.823s
OK
$ python3 scripts/package-release-binaries-test.py
Ran 9 tests in 5.787s
OK
$ python3 scripts/publish-platform-artifacts-test.py
Ran 18 tests in 45.579s
OK
$ python3 scripts/install-bootstrap-test.py
Ran 95 tests in 75.667s
OK (skipped=4)
$ python3 scripts/gateway-healthz-smoke-test.py
Ran 24 tests in 42.246s
OK (skipped=3)

On c647ecf7 (the merge above):

$ env -i PATH=/usr/local/bin:/usr/bin:/bin HOME=$HOME python3 -I -S scripts/release-signer-test.py
Ran 88 tests in 2.799s
OK
$ python3 scripts/install-bootstrap-test.py
Ran 98 tests in 70.132s
OK (skipped=4)
$ python3 scripts/package-release-binaries-test.py
OK

On f4cf806a (the merge of #398 at 32f4abfd): env -i PATH=/usr/local/bin:/usr/bin:/bin python3 -I -S scripts/release-signer-test.py OK; python3 scripts/install-bootstrap-test.py OK (skipped=4).

On 39f53389 (the merge of #398 at da63c235): install-bootstrap-test.py Ran 98 tests ... OK (skipped=4) with the host's GNU mktemp, and the same with an Apple-like mktemp stub first on PATH (see #398); env -i PATH=/usr/local/bin:/usr/bin:/bin HOME=$HOME python3 -I -S release-signer-test.py 88 OK and release-platform-input-test.py 164 OK; ci-release-policy-test.py 103 OK; package-release-binaries-test.py 9 OK; gateway-healthz-smoke-test.py 26 OK (3 skipped); git diff --check clean.

Nothing is skipped in the signer test now: gh is in /usr/local/bin on this host, and the one skip on bb874fe8 was a run whose PATH left it out. git diff --check clean. The signer test runs with -I -S in a clean environment, as release-platform-input-test.py runs it; release-signer.py refuses the TLS proxy variables this test host sets. The 3 skipped smoke cases are IPv6 (no IPv6 loopback on the test host).

Negative checks from 095084ff (this PR's own change is unchanged since; re-run not repeated on later merges):

• Both release platforms refused checks turned into assert: test_optimized_cli_refuses_x86_64_darwin_and_signs_nothing fails with 'ValueError: package artifact prefix refused' != 'ValueError: release platforms refused'. The later prefix gate still stops the input, so nothing is signed.
• x86_64-darwin added to COMPONENT_KEYS: test_intel_package_key_prints_and_packaging_refuses_the_tarball fails with 'x86_64-darwin' unexpectedly found in frozenset(...).

CI

• This PR is stacked on Stop Intel Mac before release lookup and pin the verified head CID #398, so its CI tests it merged into Stop Intel Mac before release lookup and pin the verified head CID #398's branch, not develop. develop's own Home link test failure (403 vs 200, fixed in develop by bfefe92) did not apply to this PR.

Runs 39018384842 and 39019375337 were cancelled when the next merge was pushed; run 39022807547 (e06de657) is superseded by the push of 42b91fd8. No job failed in them. Run 39033222479 (42b91fd8) was cancelled. Run 39038272177 (bb874fe8) was still in progress when c647ecf7 was pushed. The run for 39f53389 is the one to read.

Principles check

• P10. One set feeds prepare() and the artifact prefix.
• P11. An unknown platform is refused before artifact fetch.
• P12. The signer has one allowlist.
• P15. No new platform is admitted.

Intel stays C. No grade here is a merge approval. Opening this allowlist is a release decision for the team, and this draft does not make that decision.

Team issues to open

1. Signed Intel artifact and journey. Title: Signed x86_64-darwin artifact, darwin-amd64 payloads, and Home journey. Admit x86_64-darwin only in the pull request that also adds the producer, the payload set, and the journey.
2. Adversarial review. Title: Adversarial review for the release signer allowlist. An independent review on the exact SHA, before any later admission.
3. Maintainer DID override in install.sh is asked on Stop Intel Mac before release lookup and pin the verified head CID #398; it reaches this PR through the merge. The team decided it in Follow-ups from Sasha's 0.8.0 pre-release review (#375) #434; Stamped installer: no environment or flag override of the maintainer DID #435 implements it.

[SashaMIT]

42b91fd8 merges #398 at 51404a76 (no conflict): plain Intel stop, Rosetta as Apple silicon, installer uses only checked bytes. This PR's own diff is unchanged.
Re-run on the merge: release-signer-test.py 88 OK (-I -S), release-platform-input-test.py 164 OK, package-release-binaries-test.py 9 OK, install-bootstrap-test.py 95 OK.

---

Generated by Claude Code

[SashaMIT]

Round 3 review: PASS (B). One signer allowlist works. Inherits the #398 decision.

[SashaMIT]

Round 4 at f4cf806: PASS (A). 88/88; genuine merge.

[SashaMIT]

Round 5 at 39f5338: PASS (A). Genuine merge, own diff unchanged; signer suite 88/88.