fix: harden Agent recovery, corpus proof, and release signing

.github/workflows/release.yml

@@ -65,21 +65,28 @@ jobs:
         env:
           CODESIGN_CERTIFICATE_BASE64: ${{ secrets.CODESIGN_CERTIFICATE_BASE64 }}
           CODESIGN_CERTIFICATE_PASSWORD: ${{ secrets.CODESIGN_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_SESSION_STATE_DIR: ${{ runner.temp }}/keychain-session
         run: |
+          set -euo pipefail
           CERT_PATH="$RUNNER_TEMP/codesign.p12"
-          KEYCHAIN_PATH="$RUNNER_TEMP/codesign.keychain-db"
           echo "$CODESIGN_CERTIFICATE_BASE64" | base64 -D > "$CERT_PATH"
-          security create-keychain -p "" "$KEYCHAIN_PATH"
-          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
-          security unlock-keychain -p "" "$KEYCHAIN_PATH"
+
+          # The search-list / default-keychain dance is NOT inlined here any
+          # more. This step used to prepend an ephemeral keychain to the user
+          # search list and never put the list back — it relied on
+          # `delete-keychain` unlisting it, which only works while the file
+          # still exists. On a self-hosted runner that leaves the operator's
+          # own keychain domain pointing at a deleted path (2026-08-15 P0).
+          # scripts/lib/keychain-session.sh snapshots as structured argv,
+          # unlists before deleting, and is concurrency-safe.
+          KEYCHAIN_PATH="$(scripts/lib/keychain-session.sh begin codescribe-signing)"
+          echo "CODESCRIBE_SIGNING_KEYCHAIN=$KEYCHAIN_PATH" >> "$GITHUB_ENV"
+
+          # Read into a variable, never echo. The ephemeral password exists so
+          # the keychain is not world-openable on a shared runner.
+          KEYCHAIN_PASSWORD="$(cat "$(scripts/lib/keychain-session.sh password-file codescribe-signing)")"
           security import "$CERT_PATH" -P "$CODESIGN_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
-          existing_keychains=()
-          while IFS= read -r keychain; do
-            keychain="${keychain//\"/}"
-            [[ -n "$keychain" ]] && existing_keychains+=("$keychain")
-          done < <(security list-keychains -d user)
-          security list-keychains -d user -s "$KEYCHAIN_PATH" "${existing_keychains[@]}"
-          security set-key-partition-list -S apple-tool:,apple: -s -k "" "$KEYCHAIN_PATH"
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" >/dev/null
           security find-identity -v -p codesigning "$KEYCHAIN_PATH"
           # The identity now lives in the keychain; the raw PKCS12 has no
           # further use. Overwrite-then-unlink so the private key material
@@ -187,12 +194,24 @@ jobs:
             appcast.xml
           generate_release_notes: true
 
-      - name: Remove signing keychain
+      - name: Release the signing keychain
         # Runs on every outcome: a failed build must not leave the imported
-        # Developer ID identity resident on the runner.
+        # Developer ID identity resident on the runner, AND must not leave the
+        # ephemeral keychain in the user search list or as the default
+        # keychain. `end` unlists first and deletes second, so it still cleans
+        # up when the keychain file has already been destroyed — the exact
+        # sequence that poisoned the operator's host on 2026-08-15.
         if: always()
+        env:
+          KEYCHAIN_SESSION_STATE_DIR: ${{ runner.temp }}/keychain-session
         run: |
-          KEYCHAIN_PATH="$RUNNER_TEMP/codesign.keychain-db"
-          if [ -f "$KEYCHAIN_PATH" ]; then
-            security delete-keychain "$KEYCHAIN_PATH"
+          if [ ! -x scripts/lib/keychain-session.sh ]; then
+            echo "::warning::checkout missing; cannot release the signing keychain"
+            exit 0
           fi
+          scripts/lib/keychain-session.sh end codescribe-signing
+          # Read-only verdict on what the runner's keychain domain looks like
+          # now. Advisory: a dirty domain must be visible, not silent, but it
+          # must not fail an otherwise successful release.
+          scripts/keychain-doctor.sh || \
+            echo "::warning::runner keychain domain still has stale entries after cleanup"

Cargo.toml

@@ -45,6 +45,10 @@ path = "bin/codescribe.rs"
 name = "codescribe-teacher"
 path = "bin/codescribe-teacher.rs"
 
+[[bin]]
+name = "codescribe-corpus"
+path = "bin/codescribe-corpus.rs"
+
 [lib]
 path = "app/lib.rs"
 
@@ -107,6 +111,7 @@ chrono = "0.4"
 
 # UUID generation
 uuid = { version = "1", features = ["v4"] }
+sha2 = "0.10"
 
 # Lazy static for global state
 lazy_static = "1.4"
@@ -136,7 +141,6 @@ tempfile = "3"
 mockito = "1"
 serial_test = "3"
 hound = "3.5"
-sha2 = "0.10"
 
 [lints.rust]
 # Allow unexpected_cfgs from objc crate's msg_send! macro (uses cargo-clippy cfg internally)

Makefile

@@ -9,7 +9,7 @@
         bump bump-patch bump-minor bump-major version \
         lint format test test-quick test-e2e test-e2e-real test-sse test-sse-release test-responses-live test-sse-heavy test-formatting test-all \
         test-engine test-engine-apple test-engine-candle test-teacher \
-        demo demo-raw demo-assistive check verify semgrep fix clean help \
+        demo demo-raw demo-assistive check verify semgrep fix clean help corpus-census test-corpus-parity \
         dist-preflight dist-preflight-signed verify-canaries smoke-canaries \
         dmg dmg-signed release-standard release-full release-dmgs notarize verify-dmg download-model download-e5 download-embedder ensure-models \
         hooks
@@ -77,6 +77,18 @@ LOCAL_LLM_ENDPOINT ?= http://localhost:11434/v1/responses
 LOCAL_LLM_MODEL ?= gpt-oss:120b-cloud
 LOCAL_LLM_API_KEY ?= local
 
+# Content-private corpus inventory and production-session replay. The binary
+# hard-disables Keychain and never loads operator settings/.env. Machine reports
+# are content-redacted; private mode-0600 Qube HTML carries review transcripts.
+CORPUS_ROOTS ?= $(HOME)/.codescribe/data_assets $(HOME)/.codescribe/transcriptions
+CORPUS_REFERENCE_POLICY ?= human
+CORPUS_PROFILES ?= apple-layer0,apple-layer1-inprocess
+CORPUS_RUNS ?= 1
+CORPUS_MAX_RECORDINGS ?= 1
+CORPUS_APPLE_BRIDGE ?= /Applications/Codescribe.app/Contents/MacOS/codescribe-stt-bridge
+CORPUS_RUN_ID ?= $(shell date +%Y%m%d-%H%M%S)
+CORPUS_OUT ?= $(HOME)/.vibecrafted/artifacts/vetcoders/codescribe/$(shell date +%Y_%m%d)/reports/corpus-$(CORPUS_RUN_ID)
+
 define APPLY_TEST_LLM
 if [[ "$(TEST_USE_LOCAL_LLM)" == "1" ]]; then \
   export LLM_ENDPOINT="$(LOCAL_LLM_ENDPOINT)"; \
@@ -102,22 +114,23 @@ build:
 	@echo "Building (debug)..."
 	@cargo build
 
-# Slim public default: Silero VAD + MiniLM. Whisper is runtime/cache/Settings download.
-# Do NOT set CODESCRIBE_EMBED_WHISPER here — that is the fat experimental SKU only.
+# Slim public default: Silero in the dylib; MiniLM is a signed app resource;
+# Whisper is runtime/cache/Settings download. Large model bytes never flow
+# through normal Cargo targets.
 release-codescribe: dist-preflight
-	@echo "Building codescribe-ffi (release dylib, embedded: Silero + MiniLM; Whisper runtime)..."
+	@echo "Building codescribe-ffi (release dylib: Silero embedded; MiniLM/Whisper runtime)..."
 	@echo "  The app front-end is no longer a Rust bin; this builds the UniFFI bridge dylib."
 	@echo "  Produce the runnable SwiftUI app with: make app PROFILE=release"
 	@echo "  Fat Whisper embed: make release-codescribe-embedded"
 	@CODESCRIBE_LICENSE_PUBLIC_KEY_HEX="$(CODESCRIBE_DIST_LICENSE_KEY)" \
-	 env -u CODESCRIBE_EMBED_WHISPER -u CODESCRIBE_NO_EMBED cargo build --release -p codescribe-ffi
+	 env -u CODESCRIBE_EMBED_WHISPER -u CODESCRIBE_EMBED_EMBEDDER -u CODESCRIBE_NO_EMBED cargo build --release -p codescribe-ffi
 
 # Optional fat SKU / offline curiosity: bake Whisper into the dylib (~1GB+).
 # Not the daily release path. Pair with `make release-full` for a _full DMG.
 release-codescribe-embedded: dist-preflight ensure-models
-	@echo "Building codescribe-ffi (FAT: Silero + MiniLM + Whisper embedded)..."
+	@echo "Building codescribe-ffi (FAT Whisper: Silero + Whisper embedded; MiniLM runtime resource)..."
 	@CODESCRIBE_EMBED_WHISPER=1 CODESCRIBE_LICENSE_PUBLIC_KEY_HEX="$(CODESCRIBE_DIST_LICENSE_KEY)" \
-	 cargo build --release -p codescribe-ffi
+	 env -u CODESCRIBE_EMBED_EMBEDDER cargo build --release -p codescribe-ffi
 
 # ── SwiftUI app (macos/) via the codescribe-ffi UniFFI bridge ────────────────
 # Full verified pipeline: cargo (ffi dylib) → uniffi-bindgen → xcodegen → xcodebuild.
@@ -138,10 +151,10 @@ release-qube: dist-preflight
 release: release-codescribe release-qube
 
 install:
-	@echo "Installing qube tools + codescribe CLI (slim: Silero + MiniLM; Whisper from cache / Settings)..."
+	@echo "Installing qube tools + codescribe CLI (Silero embedded; MiniLM/Whisper from cache)..."
 	@echo "Local install uses the development license verifier — same contract as install-app."
 	@./scripts/download-embedder.sh || true
-	@env -u CODESCRIBE_EMBED_WHISPER -u CODESCRIBE_NO_EMBED -u CODESCRIBE_LICENSE_PUBLIC_KEY_HEX \
+	@env -u CODESCRIBE_EMBED_WHISPER -u CODESCRIBE_EMBED_EMBEDDER -u CODESCRIBE_NO_EMBED -u CODESCRIBE_LICENSE_PUBLIC_KEY_HEX \
 	 CODESCRIBE_LOCAL_INSTALL=1 cargo install --path . --force
 	@mkdir -p ~/.codescribe
 	@$(MAKE) hooks
@@ -298,7 +311,8 @@ bump-major:
 # gate: verify class=hermetic ci=yes -- the workspace test set + doctests + env registry + this ledger; the command rust.yml runs
 # gate: verify-canaries class=hermetic ci=no -- claim-vs-execution canaries that read repo files only (scripts/canaries.sh); each row is born from a named incident
 # gate: verify-swift-format class=static ci=no -- swift-format lint --strict over macos/Codescribe + macos/CodescribeTests; skips the generated UniFFI binding; no Swift tests (that is test-swift)
-# gate: smoke-canaries class=operator ci=no -- verify-canaries + host rows: dist inputs, appcast feed, live-store purity, Sparkle key parity (scripts/canaries.sh --host)
+# gate: smoke-canaries class=operator ci=no -- verify-canaries + host rows: dist inputs, appcast feed, live-store purity, Sparkle key parity, keychain domain cleanliness (scripts/canaries.sh --host)
+# gate: test-keychain-session class=hermetic ci=no -- ephemeral signing-keychain contract (scripts/tests/keychain-session-test.sh) against a FAKE security binary and a temp HOME; touches no real keychain
 # gate: verify-dmg class=operator ci=no -- fail-closed payload check against an already-built DMG; release.yml runs the same check via scripts/verify-dmg-payload.sh, not via this target
 # gate: test class=operator ci=no -- workspace tests + #[ignore] real-API tests + STT pipeline; sources ~/.codescribe/.env and opens Console
 # gate: test-quick class=operator ci=no -- workspace tests only, but still sources ~/.codescribe/.env and opens Console
@@ -317,6 +331,7 @@ bump-major:
 # gate: test-engine-parity class=operator ci=no -- Layer 0 parity bar vs the Apple reference; private corpus, host-local bench
 # gate: test-engine-parity-layered class=operator ci=no -- Layer 1 parity arm judged on structure; private corpus, host-local bench
 # gate: test-engine-parity-both class=operator ci=no -- runs both parity arms and prints the delta
+# gate: test-corpus-parity class=operator ci=no -- isolated production-session file replay; private corpus and local STT models
 # gate: test-teacher class=operator ci=no -- teacher CLI proof run, writes an HTML report
 # gate: test-swift class=operator ci=no -- SwiftUI suite + Apple phrase-restart Rust/Swift lockstep self-test; needs Xcode and built ffi/bridge binaries
 # gate: smoke-macos27 class=operator ci=no -- host smoke after an OS/Xcode bump; operator-only rows report SKIP
@@ -763,6 +778,47 @@ test-engine-parity-both:
 	 fi; \
 	 [ "$$off_rc" -eq 0 ] && [ "$$on_rc" -eq 0 ]
 
+# Inventory every configured corpus root without loading operator settings,
+# dotenv or Keychain. Census always discovers historical same-stem references;
+# replay decides separately whether they are admissible as quality references.
+.PHONY: corpus-census
+corpus-census:
+	@set -euo pipefail; \
+	 root_args=(); \
+	 for root in $(CORPUS_ROOTS); do root_args+=(--root "$$root"); done; \
+	 CODESCRIBE_DISABLE_KEYCHAIN=1 cargo run --quiet --bin codescribe-corpus -- census \
+	   "$${root_args[@]}" \
+	   --include-historical \
+	   --out "$(CORPUS_OUT)/census.json"
+
+# Production PCM-session replay. One recording x the two core arms is the safe
+# default; expand CORPUS_PROFILES / CORPUS_MAX_RECORDINGS deliberately for a
+# retained matrix. Each profile runs in a fresh process and isolated data root.
+.PHONY: test-corpus-parity
+test-corpus-parity:
+	@set -euo pipefail; \
+	 root_args=(); \
+	 max_args=(); \
+	 source_identity="$$(git rev-parse HEAD)"; \
+	 if [ -n "$$(git status --porcelain --untracked-files=all)" ]; then source_identity="$$source_identity-dirty"; fi; \
+	 if [ ! -x "$(CORPUS_APPLE_BRIDGE)" ]; then \
+	   printf 'corpus parity refused: signed Apple STT bridge is not executable: %s\n' "$(CORPUS_APPLE_BRIDGE)" >&2; \
+	   exit 2; \
+	 fi; \
+	 for root in $(CORPUS_ROOTS); do root_args+=(--root "$$root"); done; \
+	 if [ -n "$(strip $(CORPUS_MAX_RECORDINGS))" ]; then \
+	   max_args+=(--max-recordings "$(CORPUS_MAX_RECORDINGS)"); \
+	 fi; \
+	 CODESCRIBE_DISABLE_KEYCHAIN=1 cargo run --quiet --bin codescribe-corpus -- run \
+	   "$${root_args[@]}" \
+	   "$${max_args[@]}" \
+	   --out-dir "$(CORPUS_OUT)" \
+	   --profiles "$(CORPUS_PROFILES)" \
+	   --runs "$(CORPUS_RUNS)" \
+	   --references "$(CORPUS_REFERENCE_POLICY)" \
+	   --apple-bridge "$(CORPUS_APPLE_BRIDGE)" \
+	   --commit "$$source_identity"
+
 # Host smoke for the macOS surfaces we own — run after every OS/Xcode bump.
 # Headless, raises no TCC dialog, posts no synthetic events; operator-only rows
 # report SKIP instead of passing quietly. SMOKE_ARGS='--with-inference' adds the
@@ -1055,6 +1111,15 @@ verify-canaries:
 smoke-canaries:
 	@bash scripts/canaries.sh --host
 
+# The signing keychain borrows the operator's user keychain domain. This proves
+# it always gives it back — on success, on failure, on Ctrl-C, under concurrent
+# releases, and when the keychain file was destroyed before cleanup ran (the
+# 2026-08-15 P0). Hermetic: `security` is a fake binary in a temp dir and HOME
+# is redirected, so running it on this host cannot touch a real keychain.
+.PHONY: test-keychain-session
+test-keychain-session:
+	@bash scripts/tests/keychain-session-test.sh
+
 .PHONY: canary-catalog
 canary-catalog:
 	@bash scripts/canaries.sh --list
@@ -1103,7 +1168,7 @@ help:
 	@printf '\n'
 	@printf '  $(HELP_C_YELLOW)%s$(HELP_C_RESET)\n' 'BUILD & INSTALL'
 	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'build' 'Build debug binary'
-	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'release' 'Build release dylib slim (Silero + MiniLM; Whisper runtime)'
+	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'release' 'Build release dylib slim (Silero embedded; MiniLM/Whisper runtime)'
 	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'install' 'Install CLI slim (Whisper via cache/Settings, not embedded)'
 	@printf '%s\n' '  make install-no-embed DEV/RECOVERY: no optional embeds (runtime paths only)'
 	@printf '%s\n' '  make release-codescribe-embedded Fat dylib with Whisper baked in (not daily)'
@@ -1160,6 +1225,8 @@ help:
 	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'test-engine-apple' 'Apple live multi-utterance e2e (ENGINE_CLIP / ENGINE_ALL_CLIPS=1)'
 	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'test-engine-candle' 'Candle live multi-utterance e2e (same engine bar)'
 	@printf '%s\n' '  make test-engine-parity-both Both parity arms + delta (needs the private corpus)'
+	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'corpus-census' 'Inventory both private corpus roots; hashes/counts only'
+	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'test-corpus-parity' 'Isolated production replay (profiles/runs/recordings are explicit vars)'
 	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'test-teacher' 'Teacher CLI proof HTML (live×whisper×human)'
 	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'test-all' 'Run full test suite'
 
@@ -1206,7 +1273,8 @@ dist-preflight-signed: dist-preflight
 	fi
 	@echo "dist preflight: Sparkle public key OK (32-byte Ed25519 from $(if $(SPARKLE_ED_PUBLIC_KEY),environment,$(CODESCRIBE_SPARKLE_PUBLIC_KEY_FILE)))"
 
-# Daily slim DMG (public default): Silero + MiniLM, Whisper NOT embedded.
+# Daily slim DMG (public default): Silero embedded, MiniLM runtime resource,
+# Whisper NOT embedded.
 dmg: dist-preflight
 	@CODESCRIBE_LICENSE_PUBLIC_KEY_HEX="$(CODESCRIBE_DIST_LICENSE_KEY)" ./scripts/build-dmg.sh
 
@@ -1235,7 +1303,8 @@ release-standard: dist-preflight-signed
 	./scripts/verify-dmg-payload.sh "$$DMG" --variant slim --version "$$VERSION"
 
 # Optional fat SKU: bake Whisper (~1GB+) into the app. Not the daily path.
-# Ends with the fail-closed payload gate (full = Silero + MiniLM + Whisper).
+# Ends with the fail-closed payload gate (full = Silero + Whisper embedded,
+# MiniLM runtime resource).
 release-full: dist-preflight-signed ensure-models
 	@CODESCRIBE_CODESIGN_IDENTITY="$(CODESCRIBE_DIST_CODESIGN_IDENTITY)" \
 	 CODESCRIBE_LICENSE_PUBLIC_KEY_HEX="$(CODESCRIBE_DIST_LICENSE_KEY)" \

README.md

@@ -103,7 +103,7 @@ Codescribe can load custom MCP servers from `~/.codescribe/mcp.json`. That keeps
 ## Features
 
 - **Rust core + SwiftUI app** — Native macOS SwiftUI shell over the Rust engine through UniFFI, with candle-core + Metal GPU
-- **Two DMG variants** — Standard (daily) embeds Silero VAD + MiniLM; Whisper is downloaded from Settings → Dictation or HF cache. Optional `_full` DMG also embeds Whisper for offline/curiosity installs.
+- **Two DMG variants** — Standard (daily) embeds Silero VAD and signs MiniLM as a runtime app resource; Whisper is downloaded from Settings → Dictation or HF cache. Optional `_full` DMG also embeds Whisper for offline/curiosity installs.
 - **Whisper Live** — Streaming transcription happens _during recording_ (chunks + overlap), so `stop()` is
   near-instant
 - **Stream postprocess** — semantic gating + cleanup of live chunks before final output
@@ -334,7 +334,7 @@ Codescribe uses **whisper-large-v3-turbo** (mlx-community, fp16):
 
 ### Runtime Whisper (Current)
 
-**Daily public builds are slim.** `make release`, `make dmg` / `dmg-signed`, and `make release-standard` embed **Silero VAD** (required) and **MiniLM** when available. **Whisper is not baked in** (~900 MB–1.5 GB saved). Install local Candle Whisper from **Settings → Dictation → Download Whisper**, or run `make download-model`.
+**Daily public builds keep large weights out of Cargo artifacts.** `make release`, `make dmg` / `dmg-signed`, and `make release-standard` embed only **Silero VAD** in the Rust engine. **MiniLM** is copied into the signed app as a runtime resource, while **Whisper is not baked in** (~900 MB–1.5 GB saved). Install local Candle Whisper from **Settings → Dictation → Download Whisper**, or run `make download-model`.
 
 Optional fat SKU (offline / curiosity): `make release-full` or `CODESCRIBE_EMBED_WHISPER=1` / `make release-codescribe-embedded`.
 
@@ -350,7 +350,7 @@ The mlx-community repo ships only `config.json` + `weights.safetensors`;
 the download paths compose `tokenizer.json` + `mel_filters.npz` from the
 legacy repo (both files are quantization-independent).
 
-`CODESCRIBE_NO_EMBED=1` is a development/recovery path that also skips MiniLM embed; it is not the public slim product path.
+`CODESCRIBE_EMBED_EMBEDDER=1` is an explicit fat/debug path that compiles MiniLM into Rust artifacts. Normal builds resolve MiniLM from the signed app resource or HF cache. `CODESCRIBE_NO_EMBED=1` disables every optional binary embed; Silero remains embedded.
 
 Model files required: