Phase 1 REVIEW.md CR-01 (SEC-01 / D-10): `SystemKeychainStore` previously
omitted `kSecAttrAccessible` and `kSecAttrSynchronizable`, so items were
written with the OS default — eligible for iCloud Keychain migration and
Time Machine backup, contradicting the "never leaves this device"
guarantee.
packages/Keychain/Sources/Keychain/SystemKeychainStore.swift:7-40
- Add `kSecAttrAccessibleWhenUnlockedThisDeviceOnly` to every
SecItemAdd / SecItemUpdate attrs payload.
- Add `kSecAttrSynchronizable = kCFBooleanFalse` to both the query and
the attrs payload (legacy macOS keychain matches on exact sync value).
packages/Keychain/Tests/KeychainTests/KeychainTests.swift
- Add `test_itemIsNotSynchronizable`: asserts that a query with
`kSecAttrSynchronizable = true` returns errSecItemNotFound for a
freshly-written item, and the non-sync query does find it.
- Add `test_sourceAlwaysSetsDeviceOnlyAccessibility`: source-level grep
gate so a future refactor that drops either attribute fails CI.
(The legacy file-based macOS keychain does not echo
`kSecAttrAccessible` back via SecItemCopyMatching, so a runtime
assertion is not possible without entitlements for the
data-protection keychain.)
james.maes
afd2bc617e