# Evidence capture — issue 21282

Tiny declaration-only packaging fix. No rendering changes; screenshots and UI recordings are not applicable to this diff. Native recordings remain uncovered below.

## Provenance

- Base: [8acbefefc5](https://git.cafe/pingdotgg/t3code/commit/8acbefefc5).
- Red: [2c467424bb](https://git.cafe/pingdotgg/t3code/commit/2c467424bb8ac9db8c9b8e0433094747452e5f15), detached temporary worktree. Implementation matches base exactly.
- Green/CONFIG/scope: [c2405f2124](https://git.cafe/pingdotgg/t3code/commit/c2405f212447c7d6beac0c383713f7fb1e8e4945), branch `fix/issue-21282`, clean before and after.
- Same existing regression test file in both revisions (git diff exit 0). Commands used `PATH=$PWD/node_modules/.bin:$PATH` and `vp test run scripts/build-desktop-artifact.test.ts`. Linux, Node v24.21.0, Vitest v5.0.5. Node differs from package engines v26.12.1; results describe this host only.
- Shared installed dependencies through temporary ignored node_modules symlinks; no tracked files changed. Temporary worktree removed after capture. No concurrent mutations.

## Actual results

- Red: `Tests 2 failed | 41 passed (43)`, `EXIT_CODE=1`. Failures: usage description `expected undefined to be a string`; entitlement XML did not match Apple Events key followed by true.
- Green: `Test Files 1 passed (1)`, `Tests 43 passed (43)`, `EXIT_CODE=0`.
- CONFIG: real exported `resolveMacPasskeySigningConfiguration`, `renderMacPasskeyEntitlements`, and `createBuildConfig` executed; `EXIT_CODE=0`. Synthetic inputs only, empty config environment, NodeServices layer. This is not native proof or a packaging/signing run.
- Scope: `DIFF_CHECK_EXIT=0`, `LINT_EXIT=0`, `FORMAT_EXIT=0`, `TYPECHECK_EXIT=0`; scripts-package typecheck only. Two changed files, 28 insertions relative to base. Both provenance identity checks exit 0. No repo-wide checks.

## Matrix

| ID | Status | Actual proof and boundary |
| --- | --- | --- |
| C1 | CONFIG verified | Unsigned mac/dmg version 0.0.33-pr.8182.1 emits `NSAppleEventsUsageDescription`: `T3 Code lets commands run by terminals and coding agents control other apps.` Same string in signed config. Regression green; no final Info.plist inspected. |
| C2 | CONFIG verified | Synthetic team ABC1234567, app com.t3tools.t3code, normalized domains clerk.example.com and example.clerk.accounts.dev. Real generator emits Apple Events key followed by true; existing associated domains, JIT, camera/audio entries retained; Touch ID and browser passkeys absent as configured. Regression red/green independently captured. |
| C3 | CONFIG + source verified | Signed config consumes /tmp/synthetic-entitlements.mac.plist and /tmp/synthetic.provisionprofile; unsigned config has neither property. Source wiring gates file generation on signed mac plus resolved signing config. No actual provisioning profile, generated file stage, build, signing or helper inheritance executed. |
| A1 | cannot-verify macos-desktop | Linux cannot inspect candidate signed macOS app Info.plist, signatures or helper inheritance. Obtain final artifact on macOS. |
| N1 | cannot-verify macos-desktop | Fresh Automation allow decision and actual native Codex/helper cleanup require macOS recording plus cleanup outcome. |
| N2 | cannot-verify macos-desktop | Persisted allowed-state repeat cleanup requires macOS recording plus outcome. |
| N3 | cannot-verify macos-desktop | Deny/revoke, real failure handling, grant/retry and any restart require macOS recording plus outcome. |

Native macOS desktop/TCC/helper cleanup and final signed artifacts were not verified on this Linux VM. Current evidence proves declarations/config coverage only.

## Public artifacts

- [red-2c467424bb.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9ebf16db4cc26d4b/red-2c467424bb.log)
- [green-c2405f2124.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/322db1a5065e9ee0/green-c2405f2124.log)
- [config-c2405f2124.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/48b6ed4d478ec840/config-c2405f2124.log)
- [scope-c2405f2124.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/41800122f447599d/scope-c2405f2124.log)
- [config-runner.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/653d2924b0c12f69/config-runner.mjs)

## FRICTION

| Category | Happened | Remedy |
| --- | --- | --- |
| Dependency resolution | First temporary-worktree attempts failed before tests because workspace and scripts dependency directories were absent. | Link existing installed node_modules directories into isolated checkout; rerun exact revision. Published red transcript is the completed regression run. |
| CONFIG harness | Initial direct execution lacked package resolution and Effect Path service. | Resolve installed scripts dependencies explicitly and provide NodeServices; final real-export execution exits 0. |
| Platform / native evidence | Host is Linux; no macOS runtime, signed app or TCC interaction. | Mark A1/N1–N3 cannot-verify macos-desktop; obtain native evidence before claiming end-to-end cleanup success. |
| Runtime version | Host Node v24.21.0 differs from declared engine v26.12.1. | Attribute host version; rerun on release runtime if that claim is needed. |

## Changes and publication safety

Product/test changes made by this evidence step: none. No commits, PR, push, watcher, browser, delegation or visual claims. Only external logs, CONFIG runner and this matrix were created; temporary worktree was cleaned up. Logs inspected before ghdrop upload: source/config, synthetic fixture paths, revision IDs and tool results only; no credentials or user data. Prior review MERGE verdicts were not independently audited here.