[oddessentials]

• A sign-macos job, in the release-signing environment, takes the macOS build's zip and checks its hash. tools/macos/sign.sh then signs the finished app (kits included) with the Developer ID Application certificate and the hardened runtime from a temporary keychain, notarizes it, staples it and zips it again, as agent-guild's installer script does.
• The job runs the signed app (world creation and the MCP smoke test) and checks its signature: Developer ID for team H3FY62W58W, hardened runtime, no entitlements, and Gatekeeper accepting it as notarized.
• The release publishes only that signed zip, checked against sign-macos's hash, so the ad-hoc zip can never ship. Pull requests stay ad-hoc signed.
• The app already runs under the hardened runtime with no entitlements, so none are added, and the check refuses any.
• tests/macos_signature.sh checks the refusals without credentials or network, and runs in every macOS build.

README

• Carries docs/readme-cleanup forward unchanged. The README holds only the install button and the "For agents" link.
• The install button shows Windows and Apple marks after "AGENT GUILD: BUILDERS" in place of "FOR WINDOWS". tools/make_install_button.py draws them, and both button images are regenerated.

Validation

• A manual run of the signing commit, 42755134747, signed, notarized and stapled the app. The signed app passed the smoke test and every signature check. release was skipped. The branch was allowed in release-signing only for that run.
• Locally, tests/macos_signature.sh passed against the packaged app, and removing each rule from check_app makes its test fail. actionlint and shellcheck are clean.

🤖 Generated with Claude Code