phase8: COMPLETE — notarized universal release (spctl: Notarized Developer ID), stapled app + DMG; entitlements AMFI fix; Definition of Done sweep · fe67786 · zyquo-cloud

phase8: COMPLETE — notarized universal release (spctl: Notarized Developer ID), stapled app + DMG; entitlements AMFI fix; Definition of Done sweep

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

simon-pierre boucher committed 1 mo ago (Jul 30, 2026) parent 042bcd6

2 changed files +26 −15

modified Resources/ZyquoCloud.entitlements +0 −10

		`@@ -2,16 +2,6 @@`
2	2	<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3	3	<plist version="1.0">
4	4	<dict>
5		− <!--
6		− ZyquoCloud.entitlements — Zyquo Cloud
7		− Author: Simon-Pierre Boucher / Mail: contact@spboucher.ai
8		−
9		− Hardened runtime is enabled at signing time (codesign --options runtime).
10		− Zyquo Cloud needs no entitlement exceptions: outbound HTTPS to the
11		− configured AI providers requires none outside the App Sandbox, and the
12		− app spawns no child code, loads no plugins, and uses no JIT. Modeled on
13		− the zyquo-term pipeline (same signing identity and notary profile).
14		− -->
15	5	<key>com.apple.security.cs.allow-jit</key>
16	6	<false/>
17	7	</dict>

modified docs/PLAN.md +26 −5

		@@ -126,11 +126,32 @@ reasoning_effort + ThinkChunk content arrays; Gemini's `models/` ID prefixes; de
126	126	DeepInfra gemma-4-31B) removed; streaming-only models flagged (`requiresStreaming`); 429/5xx
127	127	backoff added. End-to-end GUI chat verified live; auto-title now uses cheapest non-reasoning model.
128	128
129		−## Phase 8 — Signing & Notarization (in progress)
130		−
131		−- [ ] `make release`: universal binary (arm64 + x86_64 via lipo; x86_64 needs `-U` for CLT's
132		− arm64-only swiftCompatibility56), Developer ID sign (hardened runtime), notarize
133		− (`MacLustr-Notarize`), staple, `spctl` verify, DMG
	129	+## Phase 8 — Signing & Notarization ✅ (completed 2026-07-30)
	130	+
	131	+- [x] `make release`: universal binary (arm64 + x86_64 via lipo; x86_64 needs `-U` for CLT's
	132	+ arm64-only swiftCompatibility56), Developer ID sign (hardened runtime, minimal entitlements),
	133	+ notarize app zip + DMG (`MacLustr-Notarize`, both Accepted), staple both
	134	+- [x] `spctl -a -vv` → accepted, source=Notarized Developer ID · `stapler validate` OK ·
	135	+ `lipo -archs` → x86_64 arm64 · notarized app launches and quits cleanly
	136	+- [x] Gotcha fixed: AMFI rejects XML comments inside the entitlements dict — plist is now comment-free
	137	+
	138	+Phase 8 checkpoint summary: `dist/Zyquo Cloud.app` (signed, notarized, stapled, universal) and
	139	+`dist/ZyquoCloud.dmg` (notarized, stapled) ship-ready. Identity
	140	+"Developer ID Application: Simon-Pierre Boucher (3YM54G49SN)", profile MacLustr-Notarize.
	141	+
	142	+---
	143	+
	144	+## Definition of Done — final sweep (2026-07-30)
	145	+
	146	+- [x] `make release` → Developer ID-signed, notarized, stapled `Zyquo Cloud.app` (spctl-verified), zero Xcode
	147	+- [x] Cloud SVG icon (+ small-size & template variants) striking at all sizes, embedded icns + menu bar template + in-app glyph/wordmark
	148	+- [x] Light theme per Phase 4 spec (visually verified), dark derived (visually verified)
	149	+- [x] Naming coherent: "Zyquo Cloud" UI, com.zyquo.cloud, ZyquoCloud target/data folder (sweeps clean)
	150	+- [x] 12 providers configured; custom AES-GCM vault, zero Keychain usage (sweep clean)
	151	+- [x] Verification harness: 202/202 green across all providers/models with real keys (docs/VERIFICATION.md)
	152	+- [x] All Phase 6 features implemented and functional
	153	+- [x] Header audit: every code file carries the Author/Mail header (scripts/audit-headers.sh)
	154	+- [x] PROVIDERS.md ↔ ModelCatalog in sync (Phase 7 amendments recorded); 27/27 unit tests; zero compiler warnings
134	155	## Phase 2 — Architecture (pending)
135	156	## Phase 3 — SecureKeyStore (pending)
136	157	## Phase 4 — Design System (pending)
137	158