- Create Jarvis.xcodeproj with App target, Hardened Runtime, Swift 6 strict
concurrency, Manual codesign, ad-hoc identity for Debug
- Pin com.apple.security.cs.allow-jit, com.apple.developer.speech-recognition-assets,
and com.apple.security.device.audio-input in App/Jarvis.entitlements (SEC-02/SEC-03);
forbidden keys allow-unsigned-executable-memory and automation.apple-events are
explicitly excluded
- Set LSUIElement=YES, JarvisEntitlementsVerified=NO, and all four TCC usage-description
keys in App/Info.plist for future phases to consume
- Register four local SPM package refs (Keychain, Config, Logging, Shell) against
packages/ and link their library products to the Jarvis target
- Add PBXCopyFilesBuildPhase (Wrapper subpath Contents/Helpers, dstSubfolderSpec=1)
plus a post-build script that materializes the empty directory — MCP-05 codesign
infrastructure in place before Plan 05
- Add CODE_SIGNING_ALLOWED=NO for Debug only because the managed
speech-recognition-assets entitlement requires a provisioning profile;
Release signing is wired properly in Plan 05
- Stub JarvisApp.swift and AppDelegate.swift per D-02 (lifecycle-only; wiring
lands in Plan 03); asset catalog carries placeholder AppIcon set and
Icon-MenuBar-Template imageset metadata
- Track ATS public-key pinning finding in deferred-items.md — out of P1 scope
(no networking code yet; pinning is a P4/P8 Rule-4 architectural decision)
james.maes
98c58f014b