fix(packaging): preserve macOS SDK metadata for native UI

[Yuxin-Qiao]

SwiftBuild can compile a macOS 14-targeted package against the current SDK while writing sdk 14.0 into its final Mach-O LC_BUILD_VERSION. On macOS 27 this selects legacy system UI: an isolated AppKit reproduction renders 12-point window controls spaced 20 points apart, versus 14-point controls spaced 23 points apart with the correct SDK metadata. Standard buttons, search fields, and segmented controls also use different metrics.

Packaging now selects the macOS SDK explicitly and passes its actual version separately from the macOS 14 deployment target using -platform_version. Every app, CLI, and watchdog slice is checked before staging, so mismatched SDK metadata or an accidentally raised minimum OS fails packaging. Product-path queries use the same SDK. The selected SDK is discovered rather than hardcoded, and the minimum OS remains macOS 14.

Validation:

• make check passed, including 13 new metadata regressions and SDK argument/path tests; SwiftLint reported no violations in 2,938 files. Existing product-path, Info.plist, signing-configuration, and strip checks passed.

• Real isolated SwiftBuild release builds with Apple Swift 6.4 / macOS SDK 27 reproduced minos 14.0 / sdk 14.0 before the fix and minos 14.0 / sdk 27.0 afterward. Fixed arm64, x86_64, and universal products passed the checker; the original was rejected. The same flags passed with the native build engine.

• Complete packaging and full-test proof checks this PR's exact product commit efb600a2c46f6efdd446305df6a2f3d7959a6007; its additional commit contains only a separate, temporary validation workflow.

• Full discovered inventory on macOS 26 / Xcode 26.6: 1,649 selections, 216 groups, all passed on the first attempt, zero failures, timeouts, or retries. Discovery/build took 1,218.4 seconds, test execution 1,033.5 seconds, and total runner time 2,260.0 seconds. The earlier local disk-space failure is superseded by this successful hosted run.

• Complete universal release packaging passed with Xcode 26.6 / SDK 26.5: app, CLI, watchdog, Widget extension, resources, ad hoc signatures, and packaged resource/startup smoke checks. Both slices of the final three SwiftPM executables retain minimum macOS 14 and SDK 26.5; final signature verification also passed after downloading the bundle.

• The unmodified downloaded universal release bundle passed both app/CLI resource probes and an 8-second startup check on macOS 27.0.1, with real-home reads/writes and networking denied, an isolated home, and Keychain access disabled. Automated settings-window capture could not be completed because the UI tool could not connect to the isolated process. The 12/14-point visual measurements are from the synthetic AppKit reproduction, not a full-app screenshot.

• Upstream required CI passed for the unchanged PR head: lint, macOS full tests plus plugin-engine goldens, Swift 6.2 compatibility build, both Linux glibc build/test jobs, and the aggregate gate. The macOS inventory again passed all 1,649 selections / 216 groups without failures, timeouts, or retries.

CI scope: the actual baseline diff requires macOS tests/compatibility builds and Linux glibc builds; the existing musl gate skips this scripts/docs change. This PR changes no workflows, package dependencies, Swift build inputs, cache context inputs, cache invalidation rules, test inventory, timeouts, or worker counts. The standalone validation used fresh runners without restoring compiled caches, so it is not evidence of incremental-build performance. Both upstream macOS lanes downloaded caches but conservatively cleaned products after detecting seven cached build-input paths absent from the checkout (fallback: build input paths changed, restored: 0). Compatibility compilation took 1,352.83 seconds; full-test discovery/build took 1,534.5 seconds and execution 1,279.3 seconds. No cache rules were bypassed. This PR introduces no ongoing CI jobs or performance-optimization claim.

This change addresses linked-SDK metadata. Settings sidebar/search/titlebar redesign and older macOS runtime or Widget-host visual qualification are separate work.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

This PR explicitly selects the macOS SDK and validates executable metadata before packaging while retaining macOS 14 support.

Example: Build a macOS 14-targeted executable with macOS SDK 27.

• Before: The reported SwiftBuild reproduction records minos 14.0 and sdk 14.0, selecting legacy native controls.
• After: Packaging supplies minos 14.0 and sdk 27.0 and rejects slices with incorrect metadata.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The focused, owner-approved patch has no identified correctness defect, but supplied validation only partially demonstrates its user-visible result.
Proof confidence	🦪 silver shellfish (2/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Newer macOS versions can render legacy native controls when packaged executables incorrectly identify the deployment target as their linked SDK.
Reason: The repair targets the reported metadata cause, retains deployment support, and has explicit direction from the packaging owner in the current head commit.

Merge readiness

⛔ Blocked before merge - 1 item remains

Keep this PR open: current main lacks this useful, maintainer-approved packaging repair, and no concrete introduced defect was found.

Priority: P2
Reviewed head: b87532d0665002c6c7e51ec86dbc165f2a43ac37

Before merge

• Add real behavior proof - The linked workflow exercises universal packaging and metadata checks for the earlier product revision, whose SDK/linker arguments are preserved by the current simplification; startup and synthetic AppKit measurements do not show CodexBar's changed native appearance. Provide a screenshot or recording from the freshly packaged app on macOS 27, identifying its build and selected SDK and redacting private account details; the blocked Actions-log download requires no contributor action. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Findings

None.

Tests

• Missing end-to-end proof: Native CodexBar controls on macOS 27 have not been shown from the freshly packaged app.

Agent review details

How this fits together

The packaging scripts turn SwiftPM products into the signed app bundle; SDK selection enters the build, and checked app, CLI, and watchdog slices leave staging.

flowchart TD
  A[Selected Xcode SDK] --> B[SwiftPM build arguments]
  B --> C[Architecture products]
  C --> D[Metadata validation]
  D --> E[Product staging]
  E --> F[Signed app bundle]

Loading

Technical review

Best possible solution:

Keep SDK selection and per-slice metadata validation in the existing packaging boundary, preserving macOS 14 support.

Do we have a high-confidence way to reproduce the issue?

The contributor reports a concrete SwiftBuild before/after reproduction, and main lacks explicit metadata enforcement; this read-only review did not independently reproduce the toolchain output.

Is this the best way to solve the issue?

Explicit linker metadata addresses the reported cause, and validating fresh architecture products before staging fits the established packaging contract.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 6e118bdb5782.

Provenance checked

• Architecture builds and minimum macOS version keeps the original intent (be4964f: Support macOS 14 and Intel builds through architecture-specific products.)
• KeyboardShortcuts prerequisite build keeps the original intent (4fa7a87: Resolve dependency resources before patching and bundling their lookup.)
• SwiftPM product paths and staging keeps the original intent (fix: trust SwiftPM package product paths #1478: Trust SwiftPM-reported paths and snapshot fresh products before sequential builds replace shared output.)
• SDK validation implementation changes intended behavior with a stated reason (efb600a: Separate linked SDK metadata from the deployment target; the current maintainer commit explains consolidating validation into packaging and its existing regression suite.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Packaging repair remains absent from main: The pinned packaging hunks add explicit SDK and linker arguments and per-architecture LC_BUILD_VERSION validation; current main builds and stages without these checks. (Scripts/package_app.sh:100, b87532d06650)
• Maintainer direction and actual main delta: Peter Steinberger's head commit explicitly preserves and simplifies this contribution. Its first parent is fetched main; comparison shows only packaging scripts, their regression suite, CHANGELOG.md, and docs/RELEASING.md differ. The provider, widget, and release changes in the larger pinned comparison are already present on main. (Scripts/package_app.sh:244, b87532d06650)
• Preserved product-path contract: fix: trust SwiftPM package product paths #1478 established authoritative SwiftPM paths and staging of fresh architecture products to prevent stale binaries; this PR retains that boundary. (Scripts/package_product_paths.sh:6, 69831cad6cac)
• Preserved minimum operating system: The historical architecture-support change deliberately selected macOS 14; the current package manifest, bundle metadata, linker arguments, and validator retain that minimum. (Scripts/package_app.sh:104, be4964fa0e33)
• Real packaging execution: https://github.com/Yuxin-Qiao/CodexBar/actions/runs/38021703528 successfully ran universal release packaging and executable metadata checks. Its validation commit directly parents the earlier product head and adds only a temporary workflow. The redirected job log was blocked by the review environment. (.github/workflows/macos-sdk-validation.yml:25, 5d88d5a9586c)
• Fully inspected proof statement: The complete body confirms that settings-window capture failed and distinguishes synthetic AppKit measurements from CodexBar UI. The earlier review projection identifies the same outstanding scenario. (b87532d06650)

Likely related people:

• Peter Steinberger: Raw commit 69831ca adds Scripts/package_product_paths.sh:6 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 69831cad6cac; files: Scripts/package_product_paths.sh)
• Yuxin Qiao: Raw commit 2dcfd05 adds Scripts/package_app.sh:26 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 2dcfd05dfcf4; files: Scripts/package_app.sh)

Review metrics

Metric	Value	Why it matters
Packaging change relative to current main	Production scripts +19/-2; regression suite +38/-1; documentation +5	The focused change reuses existing staging and testing owners rather than retaining the earlier standalone checker and wrapper.

Labels

Label changes:

• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• remove rating: 🧂 unranked krab: Current PR rating is rating: 🦪 silver shellfish, so this older rating label is no longer current.

Label justifications:

• P2: Incorrect SDK metadata affects native control appearance without evidence that a core workflow is unusable.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only; repair and merge need explicit maintainer commands such as @clawsweeper autofix or @clawsweeper automerge.

History

Review history (3 earlier review cycles)

• reviewed 2026-10-10T03:38:08.196Z sha efb600a :: needs real behavior proof before merge. :: none
• reviewed 2026-10-10T07:43:31.746Z sha efb600a :: needs real behavior proof before merge. :: none
• reviewed 2026-10-10T15:36:56.615Z sha efb600a :: needs real behavior proof before merge. :: none

Reviewed October 10, 2026, 1:23 PM ET / 17:23 UTC (Revision 4).

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T07:39:49.546911Z	efb600a	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.