Defect: Keep macOS 26 hosted-runner packages redaction-clean

[Niko4417]

Lifecycle contract: docs/qa/issue-lifecycle.md.

Parent Epic: None

Planning contract

• Contract version: v3

Implementation Ready freezes the accepted behavior, reproduction boundary, impact, scope,
acceptance criteria, Quality Plan, and delivery target. A wording-only correction may retain the
version but still requires a new readiness validation and fingerprint. A semantic change increments
the version, returns the issue to status: new, and requires a new successful readiness validation.
Record actual implementation, verification, and audit evidence in pull requests or issue comments.

Finding and accepted behavior

• Finding source: production evidence
• Finding or incident reference: PR Decide lifecycle authentication for GitHub static workflow graphs (#146) #148 CI run 30628501076, failed macOS 26 jobs
  91149186697 (attempt 1) and 91153812842 (attempt 2); PR fix(quality): diagnose macOS 26 package redaction (#149) #150 CI run 30635296068,
  successful macOS 26 jobs 91171250362 (original) and 91180784764 (authorized rerun); last known green dev run 30625975050, macOS 26 job
  91141217058.
• Affected version, commit, build, or artifact: PR Decide lifecycle authentication for GitHub static workflow graphs (#146) #148 signed head
  7f6f34c0a0f37800bcd613d5b3de71f2eb95308b produced two rejected
  Keiko Native.app/Contents/MacOS/keiko-native-desktop artifacts. PR fix(quality): diagnose macOS 26 package redaction (#149) #150 signed diagnostic head
  d5e92d308f644a96d96b1ca1d42cd1f4cec05295 produced a clean package and acceptance artifact.
• Affected platforms and environments: GitHub-hosted macos-26 arm64 image
  20260728.0273.1, macOS 26.5.2 build 25F84. Both failing and passing evidence used this exact
  image/version in the same Azure region; the worker identity and source head differed.
• Observable behavior: The old exact head was rejected twice as
  package-redaction:Contents/MacOS/keiko-native-desktop. A new diagnostic head on the same hosted
  image passed package and packaged-shell acceptance. The old diagnostic exposed no denied class or
  matched value, and the rejected artifact was not retained.
• Accepted or expected behavior and authority: Productive macOS package binaries remain free of
  denied sensitive data and environment-specific paths. Package scanning continues to fail closed.
  A rejection identifies only a bounded repository-owned redaction class and artifact path, never
  the matched value. Diagnosis must distinguish a real build-host leak from a binary-scan false
  positive or head-sensitive/intermittent artifact before any owning build-layer remediation is
  authorized.
• User, enterprise, security, or operational impact: An opaque fail-closed rejection can block
  unrelated exact-head delivery to dev. Guessing or weakening the scan would risk publishing
  sensitive data or masking binary false positives.
• Severity and rationale: high delivery and package-integrity impact with correct fail-closed
  enforcement, contradictory reproduction evidence, and no evidence that a rejected artifact was
  released.
• Affected acceptance journey and checkpoint: Not applicable — package integrity and CI
  diagnostics have no desktop interaction surface.

Do not include customer data, credentials, private endpoints, raw logs, prompts, or sensitive
screenshots. Link only to evidence that satisfies repository redaction and retention policy.

Reproduction contract

• Preconditions and sanitized fixture: Clean checkout, Node.js 24.18.x, npm 11.16.x, pinned Rust
  toolchains, and GitHub-hosted macos-26 image 20260728.0273.1.
• Minimal deterministic steps:
  1. Run npm ci --ignore-scripts.
  2. Run npm run native:package.
  3. Observe package validation scan
     Keiko Native.app/Contents/MacOS/keiko-native-desktop.
  4. If rejected, record only the bounded class, artifact path, exact head, image, worker, run, and
     attempt; never record the matched value.
• Reproduction command: npm ci --ignore-scripts && npm run native:package
• Actual result: PR Decide lifecycle authentication for GitHub static workflow graphs (#146) #148 head rejected on two attempts; PR fix(quality): diagnose macOS 26 package redaction (#149) #150 diagnostic head passed both the original run and its one provider-supported specific-job
  rerun on the exact same image/version, completing package and packaged-shell acceptance twice.
• Expected result: Every build emits a redaction-clean package; a deliberately contaminated fixture
  is rejected with a bounded class and without the matched value.
• Reproduction stability: intermittent/head-sensitive with measured evidence — 2/2 failures on
  the old exact head and 2/2 passes on the diagnostic exact head; no current-head recurrence was
  observed in the provider-supported matrix.
• Smallest known affected boundary: Final executable package-byte redaction scan; the rejected class
  and its producing layer are unconfirmed.
• Known unaffected boundary: Physical macOS 26.5.1 arm64 owner packages both heads cleanly; PR Decide lifecycle authentication for GitHub static workflow graphs (#146) #148
  macos-14 was green; PR fix(quality): diagnose macOS 26 package redaction (#149) #150 macOS 14 and macOS 26 package and acceptance lanes are green.
• User-visible failure and recovery path: Not applicable — recovery requires evidence-backed clean
  rebuild or owning-layer correction, never a scan bypass or runner-image rollback.

This issue is limited to evidence-driven diagnosis plus safe diagnostic hardening until a denied
class and owning producer are confirmed. It does not assert an environment leak, binary false
positive, or production fix without evidence.

Scope

• In scope: Failure-first hermetic fixtures for every denied class and hosted-runner-sensitive
  binary content; bounded redaction-class diagnostics that never expose matched values; one additional
  exact-head macOS 26 rerun on the accepted diagnostic head; classification of
  recurrence or bounded non-reproduction; owning-layer remediation only after the denied class and
  producer are confirmed; preservation of every denial; and physical-owner plus supported macOS
  14/26 proof.
• Out of scope: Weakening, suppressing, skipping, or deleting package redaction; exposing or
  retaining matched values; pinning or rolling back a hosted runner image; changing
  supported-platform policy; speculative native/build fixes; native product behavior; lifecycle or
  ADR changes; dependencies or lockfiles; workflow topology, permissions, branch protection, or
  repository settings.
• Suspected owning module or domain: quality/native-contract.mjs package-byte classification and
  diagnostics. quality/native-process.mjs productive Rust environment becomes an authorized fix
  owner only if bounded evidence confirms a build-host class produced there.
• Trust boundaries, data classes, or privileged effects involved: Build-host filesystem paths,
  emails, endpoints, credential-shaped content, private-key markers, executable package bytes, CI
  logs, and release artifacts.
• Regression and compatibility boundary: Preserve deterministic physical-owner packages, supported
  macOS 14/26 clean-checkout packageability, package structure, signing inputs, strict redaction
  classes, diagnostics redaction, and unrelated native behavior.

Execution Authority

The repository-wide defaults in AGENTS.md apply and are not repeated here.

• Authorized repository: oscharko-dev/Keiko-Native
• Exact delivery target: dev
• Allowed write scope: quality/native-process.mjs, quality/native-process.test.mjs,
  quality/native-contract.mjs, quality/native-package.mjs, and
  quality/native-package-contract.test.mjs
• Additional prohibited paths or actions: No workflow, native/product source, dependency,
  lockfile, lifecycle, ADR, permission, branch-protection, repository-setting, supported-runner,
  signing-policy, or unrelated quality-gate change. Never log, upload, comment, or persist a raw
  matched value.
• Authorized external mutations: Issue and pull-request planning/evidence comments; read-only
  GitHub run/job inspection; ordinary draft pull-request checks; and one explicit rerun of
  the exact accepted diagnostic head's macOS 26 job to settle measured recurrence. No other rerun,
  label/status mutation beyond this issue's accepted lifecycle requests, queue, auto-merge, merge,
  dev update, or repository-setting effect by the implementation agent.
• Required credentials or secrets: Existing authenticated maintainer environment for read-only
  GitHub evidence and ordinary branch/PR publication; credentials are never inspected, printed,
  copied, or persisted.
• Delivery authority: human-only manual merge to dev
• Additional stop or escalation conditions: Stop if recurrence identifies an owning production path
  outside the allowed write scope, if a fix requires a workflow/dependency/platform-policy change,
  if diagnostics cannot remain value-free, if any denial must be weakened, if measured evidence
  remains ambiguous after the bounded matrix, or if the current contract version lacks an exact
  accepted readiness record.

The executing agent chooses a dedicated source branch using its own runner prefix. It must include
the issue number, remain unique to this issue, and be recorded in the pull request. An agent must
never merge, enable auto-merge, enqueue, push, or update dev.

Quality Plan

• Applicable Code Quality Standard sections: Correctness and contracts; failure and recovery;
  security and privacy; observability and evidence; bounded resources; deterministic build and
  package behavior; machine acceptance; regression testing.
• Failure-first regression evidence required: A fixture at the real package-validation seam embeds
  representative content for each denied class and proves the previous rejection lacked an
  actionable bounded class; the corrected fixture remains rejected, identifies only the class, and
  contains no raw matched value in captured diagnostics.
• Positive, negative, boundary, hostile, unauthorized, unavailable, cancellation, partial-failure,
  and recovery paths to cover: Clean binary; every denied class; overlapping classes; plain and
  algorithm-prefixed private-key markers; empty and malformed artifact; binary bytes; hostile
  newline/control content; unavailable package path; scan failure; value-free diagnostic capture;
  and clean rebuild evidence. Cancellation and authorization are excluded because the bounded
  package subprocess performs no network or privileged external mutation.
• Required unit, contract, architecture, integration, production-composition, and end-to-end tests:
  Focused native process/package contract tests, complete local quality suite, physical macOS 26
  owner package command, one original exact-head macOS 14/26 run, and one authorized
  macOS 26 job rerun on the diagnostic exact head.
• Required security, accessibility, performance, resource, visual, platform, or manual evidence:
  Independent redaction/privacy audit; supported macOS evidence; signed exact-head checks; bounded
  recurrence matrix with exact image/worker/run facts. Accessibility, visual, and interactive
  journey evidence are excluded because no user-facing surface changes.
• Explicit exclusions with rationale: No product/native behavior, UI, dependency, workflow, release
  signing, or lifecycle change; the defect is confined to evidence-driven package-byte diagnosis
  and value-free diagnostics unless a producing owner is proven.

Acceptance criteria

• AC1 — Failure-first fixtures at the production package-validation seam prove every denied
  class remains rejected; diagnostics name only fixed bounded classes and artifact paths and never
  contain matched values.
• AC2 — A bounded two-run diagnostic-head macOS 26 matrix is recorded on the exact hosted
  image. If a failure recurs, its bounded class and producer are confirmed and fixed at the owning
  layer. If both runs pass, the old rejection is settled as head-sensitive/non-reproducible
  within the measured matrix and no speculative build-layer fix is made.
• AC3 — Malformed, hostile, unavailable, overlapping-class, plain private-key, and clean package
  cases remain deterministic and fail closed where applicable; no regex, gate, trust boundary, or
  supported platform is weakened or bypassed.
• AC4 — Focused tests, complete local green bar, physical-owner package proof, signed exact-head
  macOS 14/26 checks, independent privacy audit, and zero unresolved review conversations establish
  the bounded outcome without unrelated changes.

Verification commands

node --test quality/native-process.test.mjs quality/native-package-contract.test.mjs
npm ci --ignore-scripts
npm run native:package
npm run quality
npm audit --audit-level=high

Audit plan

• Required independent audit dimensions: Diagnostic value redaction, denied-class preservation,
  regex-on-binary behavior, false-positive risk, path normalization, package scan completeness,
  hostile fixtures, supported-platform parity, deterministic outputs, and scope containment.
• Owning runtime paths and neighboring defect-class paths to inspect: Productive Rust environment,
  Cargo/Rust path remapping, subprocess environment inheritance, executable build, package assembly,
  recursive package scan, redaction classification, binary boundary behavior, and error
  serialization.
• Evidence required to settle confirmed findings: Baseline failure; bounded class fixtures; exact
  image/worker/run recurrence matrix; focused and complete local green bar; physical-owner package;
  exact-head macOS 14/26 checks; independent audit; zero unresolved findings.

Definition of Ready

• Accepted and observed behavior, impact, authority, affected boundary, and non-goals are clear.
• The finding is reproducible, or the issue is explicitly limited to diagnosis.
• Acceptance criteria, Quality Plan, Execution Authority, and deterministic commands are
  complete.
• No unsupported root-cause or fix claim is presented as fact.

Completion and review settlement

• Failure-first evidence and the bounded diagnosis are recorded.
• Acceptance criteria and Quality Plan pass on the exact current head.
• The affected defect class and meaningful neighboring paths were audited.
• Confirmed findings are resolved, human-accepted, or linked to a scoped non-blocking follow-up.
• Documentation, known limitations, and residual risks match the measured outcome.

Stop conditions

• Stop when the current contract version does not match its automated readiness record.
• Stop when reproduction evidence contradicts the accepted behavior or expands the affected scope.
• Stop when a suspected cause is unconfirmed or the owning layer cannot be identified.
• Stop when a fix would weaken a gate, trust boundary, compatibility guarantee, or unrelated
  behavior.
• Stop when diagnosis requires customer data, an undeclared secret, or an unauthorized external
  mutation.

[github-actions]

Issue readiness accepted

• Status: accepted
• Contract version: v1
• Fingerprint: cf3e2342de34d84d438a1f88bfeec299593ef19b0d3ba482ae7bb13d01b7c5c0
• Triggering actor: @Niko4417
• Evaluated at: 2026-07-31T12:50:48.880Z

This exact contract is Implementation Ready while status: ready remains present.

[github-actions]

7265636f726423313731323a6669656c642334373a737472696e672331313a7265636f72645f74797065656e756d2331383a67656e65726174696f6e2d726571756573746669656c642333323a737472696e672331343a736368656d615f76657273696f6e75696e7423313a316669656c642334303a737472696e672331363a6469676573745f616c676f726974686d656e756d23373a7368612d3235366669656c642337393a737472696e672331333a6469676573745f646f6d61696e656e756d2334383a6b65696b6f2d6e61746976652e6c6966656379636c652d7265636f72642e67656e65726174696f6e2d726571756573746669656c642335353a737472696e672331303a7265706f7369746f7279737472696e672332353a6f73636861726b6f2d6465762f4b65696b6f2d4e61746976656669656c642333323a737472696e672331323a69737375655f6e756d62657275696e7423333a3134396669656c642333363a737472696e672331393a70756c6c5f726571756573745f6e756d6265726e756c6c23303a6669656c642333313a737472696e672331343a65786163745f686561645f7368616e756c6c23303a6669656c642333343a737472696e672331323a65786163745f746172676574737472696e6723333a6465766669656c642332363a737472696e6723343a6c616e65656e756d23363a6e6f726d616c6669656c642335313a737472696e672331393a7075626c69636174696f6e5f7375626d6f6465656e756d2331343a6e6f742d6170706c696361626c656669656c642333353a737472696e672331373a67656e65726174696f6e5f736368656d6175696e7423313a316669656c64233130373a737472696e672332333a67656e65726174696f6e5f62797465735f736861323536737472696e672336343a343734663165383438653266346133653539343061343534343632656332356630613138373439653030336665666536353164393339366564303336663330616669656c64233130333a737472696e672331393a67656e65726174696f6e5f6964656e74697479737472696e672336343a343734663165383438653266346133653539343061343534343632656332356630613138373439653030336665666536353164393339366564303336663330616669656c642332343a737472696e6723373a617474656d707475696e7423313a306669656c64233130303a737472696e672331363a726571756573745f6964656e74697479737472696e672336343a613461626563366538353333373264383766306334666561646431613736656561356331373666393234653539313830633466653366316333363535636331616669656c64233130363a737472696e672332323a726571756573745f7061796c6f61645f646967657374737472696e672336343a616536343535346165363032343064353234376232383261333139396531373931393666363436333162353736626230633135396531376464633130363062306669656c642336353a737472696e672331383a65787065637465645f70726f6475636572737365742333303a656e756d2332323a69737375652d636f6e74726163742d63757272656e746669656c64233131313a737472696e672332373a736f757263655f6f62736572766174696f6e5f6964656e74697479737472696e672336343a326239656630636137633337303438316139336530393633323266363366333666653766613536336536623166636165306335393864663963613664383735326669656c642333393a737472696e672332323a7072656465636573736f725f636f6d6d656e745f69646e756c6c23303a6669656c642334323a737472696e672332353a7072656465636573736f725f7265636f72645f6469676573746e756c6c23303a6669656c642336383a737472696e672331333a776f726b666c6f775f70617468656e756d2333373a2e6769746875622f776f726b666c6f77732f69737375652d6c6966656379636c652e796d6c6669656c642334343a737472696e672331353a776f726b666c6f775f72756e5f696475696e742331313a33303633323132303532326669656c642333383a737472696e672332303a776f726b666c6f775f72756e5f617474656d707475696e7423313a316669656c642337373a737472696e672331373a70726f7465637465645f6465765f736861737472696e672334303a663438366233333436666231316537333238646666353235623531353834613961313238323531316669656c642335313a737472696e672331313a7265636f726465645f6174737472696e672332303a323032362d30372d33315431323a35313a33325a

Digest: sha-256:0664795e52e71f9eed4e79a72cf228864f1c0f8ecff714d59acecbcd692176c8

[github-actions]

Issue readiness rejected

• Status: rejected
• Contract version: v1
• Fingerprint: cf3e2342de34d84d438a1f88bfeec299593ef19b0d3ba482ae7bb13d01b7c5c0
• Triggering actor: @Niko4417
• Evaluated at: 2026-07-31T14:17:22.857Z

Required corrections

• The implementation-ready label was removed.

The issue remains non-executable with status: new until validation succeeds.

[github-actions]

Issue readiness accepted

• Status: accepted
• Contract version: v2
• Fingerprint: f395c825b5079e737fb2f294552b0a623434a475c522c5b02d77ee5d76d918a9
• Triggering actor: @Niko4417
• Evaluated at: 2026-07-31T14:18:35.522Z

This exact contract is Implementation Ready while status: ready remains present.