Helpers ship with CODE_SIGNING_ALLOWED = NO so codesign.sh can apply
per-helper identity (deepest-first walker, per-helper entitlements).
If a developer flips this to YES via Xcode UI, helpers get signed with
the parent target's identity and per-helper entitlements get stripped
(MCP-06 / R1 H-B2 hazard).
Adds two pbxproj lint rules in verify-codesign-settings.sh:
- Rule 4: any `CODE_SIGNING_ALLOWED = YES` anywhere fails the build.
- Rule 5: each of the three helper targets (mcp-time, mcp-clipboard,
mcp-applescript) must declare `CODE_SIGNING_ALLOWED = NO` at least
once in its buildSettings. Awk walks the pbxproj alphabetically
(CODE_SIGNING_ALLOWED comes before PRODUCT_NAME inside each
buildSettings block) and asserts the held value when hitting the
PRODUCT_NAME line.
Verified by perturbing the local pbxproj to YES — script exits 1
with the expected error message.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- scripts/codesign.sh: deepest-first walker (find -depth) signing nested
Contents/Helpers/**/*.app with per-helper .entitlements, then main app
last. Never uses --deep (TN2206/Pitfall #3 guard).
- scripts/verify-entitlements.sh: two-mode script per RESEARCH Open Q #8.
--pre-codesign validates source + writes JarvisEntitlementsVerified=YES
to unsigned Info.plist so the flag becomes part of the signed content.
--post-codesign greps signed entitlements (via codesign -d --entitlements -)
for MAIN_REQUIRED/MAIN_FORBIDDEN + per-helper rules; never writes. Strips
XML comments before grep (self-invalidating-grep defense).
- scripts/verify-codesign-settings.sh: pbxproj linter for CodeSignOnCopy = YES,
--deep, and missing --options=runtime/--timestamp.
- scripts/test-verify-entitlements.sh: fault-injection self-test harness
that feeds good/broken/forbidden fixtures to --verify-fixture mode and
asserts exit codes.
- scripts/test-fixtures/{good,broken,forbidden}-entitlements.plist: fixtures
exercising the happy path, missing allow-jit, and forbidden apple-events.
Self-test: PASS=3 FAIL=0. Linter passes against current pbxproj.
MCP-06, SEC-02, SEC-03, SEC-08 scaffolded.
james.maesandClaude Opus 4.7