[malpern]

The saved KeyPath-Profile now returns Apple 401, and the old default API-key file is absent. Prefer the existing 62KY64SQQB App Store Connect key by default so release-candidate works without manual environment overrides. Verified notarytool history with this key, completed a notarized/stapled KeyPath release-candidate deploy from merged master using the same key, and passed release-doctor.sh --release-candidate with the new default.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T15:29:26.550429Z	beb7ef7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Review: no actionable findings. The change swaps the default App Store Connect notary key ID and key path (XQ4565NYZ7 -> 62KY64SQQB) consistently in Scripts/lib/signing.sh, the release-candidate.sh help text, and release-process.md. The key ID and path are identifiers, not secrets, and the KP_NOTARY_* env overrides still work. One thing to confirm outside the diff: the issuer UUID default is unchanged. If the new key belongs to a different team or issuer, notarization will fail with auth errors, so check that the issuer matches the new key.