[daniele21]

Outcome

Add explicit, macOS-only Swift compile / codesign / verification to canonical immutable artifact build as a separate nested signed helper. Default wheel builds stay platform-neutral and unchanged. Manifest records source SHA-256, helper SHA-256, architecture and signature kind. No run-time auto-install/exec. Missing signer or macOS fails before build and signing failure blocks promotion.

Security and scope

PRODUCT_FEATURE / INTEGRATION / FULL (packaging/toolchain/public distribution contract) / REMOTE_AUTOMATED, with REAL_ENVIRONMENT Apple Silicon installed-process proof pending (#239/#244). --native-sign-identity - is ad-hoc developer/test signing, NOT notarized or Developer-ID release readiness. No default path magic or executable trust bypass.

Acceptance

Deterministic tests for strict signer/platform checks and failure; hosted macOS CI must perform real Swift compile, codesign, signed bundle creation, manifest verification and EOF cleanup before integration. Packaging/signed test is NOT proof of actual event delivery or reclaimed memory on Mac 32 GiB.

Exact-head integration proof

• Candidate 767f346077aefcf1b15dee50bf9a7b5087abb04c / fresh dev base 7a7414c3e0dd0b8d5e0365f815be6a8b9c7e5601.
• CI INTEGRATION/FULL PASS: Python matrix, package smoke, security, L1/L2, lint, Playwright E2E and zero residue.
• Native macOS binary build and ad-hoc codesigned immutable bundle PASS; provenance manifest + SHA-256 tested.
• Repository Health PASS.
• Developer-ID notarization, installed Apple Silicon SIGKILL/host-pressure and real RAM proof remain REAL_ENVIRONMENT pending (Validate macOS backend crash cleanup and host-memory guard on 32 GB Apple Silicon #239/Mac memory safety: native pressure monitoring and evidence-gated resource relief #244).