macOS public desktop releases require a Developer ID signature, hardened runtime, secure timestamps, Apple notarization and stapled tickets. Local source development remains a separate distribution mode.
The existing release workflow builds unsigned DMG and ZIP files. The updater requires unsigned filenames. Local refresh uses a certificate-bound development identity and cannot preserve a production signature after modifying application resources.
Apple Developer ID and Apple notarization define the production acceptance criteria. Codex uses a Developer ID signature and stapled ticket. OpenProgram retains Electron Builder for the package layout, uses the native codesign and notarytool commands for distribution, and does not introduce a second identity service.
A reviewed checkout produces an unsigned staging application. The release signer signs Mach-O files and nested bundles from the inside out with one configured Developer ID. It validates the complete signature, notarizes and staples the application, creates ZIP and DMG artifacts, and notarizes and staples the DMG. All checks finish before upload. A failed command aborts release. The signer never disables Gatekeeper or changes certificate trust.
Private keys and credentials remain outside the repository. Local execution uses a dedicated keychain and a validated notarytool profile. CI uses encrypted repository secrets and a temporary keychain that is removed on exit. Only the public certificate identity belongs in build output. Source updates must not silently replace an installed production identity with a development identity.
The update client prefers signed filenames and retains explicit support for older unsigned releases. Runtime archives and Windows signing are unchanged in this task. Apple authentication, certificate issuance and notarization are external gates; passing source tests is not evidence that these gates passed.
The release signer, CI credential setup and signed-artifact selection are present. Independent source reviews and automated checks pass for the initial implementation. Timeout diagnostics and operational documentation receive scoped review. Native notarization, both-architecture acceptance and public release verification remain pending. The installed local development App retains its existing identity; replacing it with a production build is not part of local iteration.