[Release blocker] Sign and notarize the Founder Beta macOS build

[fly1d]

The current main build succeeds and launches locally, but it is arm64-only and ad-hoc signed. Gatekeeper assessment fails, so it must not be published as a normal end-user download.

Required once

• Enroll the release owner in the Apple Developer Program
• Create a Developer ID Application certificate in Apple Developer
• Export the certificate as a password-protected .p12
• Create an app-specific password for notarization
• Configure the six GitHub Actions secrets listed in docs/releasing.md
• Run the Release Desktop Beta workflow
• Verify the generated app with codesign --verify --deep --strict
• Verify Gatekeeper acceptance with spctl --assess --type execute
• Install and launch the draft artifact on a second Mac before publishing

Do not paste certificates, passwords, Apple IDs, Team IDs, or other credentials into this public issue. Configure secrets only in repository Settings -> Secrets and variables -> Actions.

Current evidence

• App bundle builds successfully at version 0.1.0-beta.1
• Local application launch and first-use UI were verified on Apple Silicon
• codesign reports Signature=adhoc and no TeamIdentifier
• spctl does not accept the bundle

Completion means the draft prerelease contains a signed, notarized artifact that passes both command-line checks and a clean-machine install test.

[fly1d]

依赖和 release workflow 已在当前 main 完成维护并通过完整门禁：tauri-apps/tauri-action 已升级到 v1，CI、Browser smoke、Desktop、CodeQL、analyze 全部通过；本地 npm run check、npm run test:smoke、npm run test:site、npm run desktop:check 也全部通过。

签名阻塞本身没有变化：仍需要 Apple Developer 证书、app-specific password 和 issue 中列出的六个 Actions secrets。没有这些凭据前，不会发布未签名安装包。配置完成后，下一步是运行 draft beta workflow，并按清单验证 codesign、Gatekeeper 和第二台 Mac 的安装。

[fly1d]

本机在当前 main 重新打包 .app 成功（arm64，版本 0.1.0-beta.1）。codesign -dv 仍显示 Signature=adhoc、TeamIdentifier=not set；spctl --assess --type execute 仍拒绝该包。该产物仅用于本机验证，未上传或发布。

[fly1d]

监控轮次补充：新一轮依赖审查已完成。@types/supertest 和 concurrently 已通过 review 与完整门禁并合入；Vite 8（需配套 plugin-react 6）和 pdf-parse 2.x 因安装/浏览器回归分别关闭。当前 main 的本地回归仍为 14 个测试、5 个浏览器冒烟（1 个配置跳过）、12 个站点测试、8 个 Rust 测试全部通过。签名/公证凭据仍是唯一 release blocker。

[fly1d]

Release preflight update (2026-08-18): PR #36 is now merged into as . The Release workflow now checks all six Apple signing secrets on Ubuntu before reserving a macOS runner and reports only missing secret names. The actual release blocker is unchanged: Apple Developer certificate, app-specific password, and the six Actions secrets are still required before any public artifact is published.

[fly1d]

Correction to the previous comment: PR #36 is merged into main as ef24614. The release preflight now checks all six Apple signing secrets on Ubuntu before reserving a macOS runner and reports only missing secret names. The signing and notarization blocker remains unchanged.