@hasna/recordings 0.2.13 → 0.3.1

package/scripts/install_macos_app.sh

@@ -146,6 +146,63 @@ require_absolute_canonical_owned_home() {
   }
 }
 
+# Every accepted argument, because until now there was no usage output at all and an
+# unrecognized argument printed only "Unknown argument". That mattered most for
+# --allow-adhoc-identity-migration: the identity-migration gate refuses a local-only
+# reinstall by default, and an operator repairing a station had no way to discover the
+# approval flag except by reading the refusal on stderr or the script itself.
+print_usage() {
+  cat <<'USAGE'
+Usage: install_macos_app.sh --artifact <zip> --manifest <json> [options]
+
+Installs a Recordings macOS app artifact transactionally. Normally invoked through
+`recordings app install`, which forwards these arguments.
+
+Artifact and version:
+  --artifact <path>                    Finalized artifact archive to install
+  --manifest <path>                    Artifact manifest describing it
+  --manifest-sha256 <sha256>           Authenticated digest of the manifest
+  --expected-source-sha <sha>          Approved 40-character source commit
+  --expected-version <version>         Version the artifact must declare
+  --expected-team-id <team-id>         Required Apple Developer team identifier
+
+Target selection:
+  --expected-hostname <name>           Require this live short hostname before mutating
+  --artifact-policy <release|local-only>
+                                       Trust policy to evaluate the artifact under
+  --approved-target <name>             Approved target for a local-only artifact
+  --approved-target-identity-kind <kind>
+                                       hardware_uuid_sha256 or tailscale_node_id_sha256
+  --approved-target-identity-sha256 <sha256>
+                                       Authenticated digest of the target identity
+
+Identity migration. Replacing an installed app with one signed by a different identity
+voids the Microphone and Accessibility grants the installed app holds; macOS keys those
+grants to code identity, and they cannot be restored by the installer. Both approvals are
+one-shot and deliberately distinct: approving a release signer rotation is not approving
+an ad-hoc replacement of a certificate-rooted install.
+  --allow-signing-identity-migration   Approve one reviewed release signer change
+  --expected-old-identity-sha256 <sha256>
+                                       Exact installed identity approved for migration
+  --expected-new-identity-sha256 <sha256>
+                                       Exact candidate identity approved for migration
+  --allow-adhoc-identity-migration     Approve replacing an installed app with an ad-hoc
+                                       signed local-only build. Required for essentially
+                                       every local-only reinstall, including a repair
+                                       install of the same version, because each ad-hoc
+                                       rebuild produces a new CDHash and is therefore a
+                                       real identity migration. Accepts that Microphone
+                                       and Accessibility must be granted again afterwards.
+  --acknowledge-local-signing-and-permissions
+                                       Acknowledge local-only ad-hoc signing up front
+
+Launch and help:
+  --launch                             Launch the app after installing
+  --launch-timeout <seconds>           Seconds to wait for the launch to settle
+  --help, -h                           Print this message and exit 0
+USAGE
+}
+
 ARTIFACT_PATH=""
 MANIFEST_PATH=""
 EXPECTED_TEAM_ID="${RECORDINGS_EXPECTED_TEAM_IDENTIFIER:-}"
@@ -162,6 +219,7 @@ APPROVED_TARGET_IDENTITY_KIND=""
 APPROVED_TARGET_IDENTITY_SHA256="none"
 ACKNOWLEDGE_LOCAL_SIGNING_AND_PERMISSIONS=0
 ALLOW_IDENTITY_MIGRATION=0
+ALLOW_ADHOC_IDENTITY_MIGRATION=0
 LAUNCH_APP=0
 LAUNCH_TIMEOUT_SECONDS="${RECORDINGS_LAUNCH_TIMEOUT_SECONDS:-10}"
 
@@ -232,6 +290,12 @@ while [ "$#" -gt 0 ]; do
       ALLOW_IDENTITY_MIGRATION=1
       shift
       ;;
+    # Distinct from --allow-signing-identity-migration: approving a release signer
+    # rotation is not approving an ad-hoc replacement of a certificate-rooted install.
+    --allow-adhoc-identity-migration)
+      ALLOW_ADHOC_IDENTITY_MIGRATION=1
+      shift
+      ;;
     --launch)
       LAUNCH_APP=1
       shift
@@ -240,8 +304,13 @@ while [ "$#" -gt 0 ]; do
       LAUNCH_TIMEOUT_SECONDS="${2:-}"
       shift 2
       ;;
+    --help | -h)
+      print_usage
+      exit 0
+      ;;
     *)
       echo "Unknown argument: $1" >&2
+      echo "Run with --help for the accepted arguments." >&2
       exit 2
       ;;
   esac
@@ -310,6 +379,19 @@ PACKAGE_ROOT="$(cd "$("$DIRNAME_EXECUTABLE" "${BASH_SOURCE[0]}")/.." && pwd)"
 ARTIFACT_TOOL="${PACKAGE_ROOT}/scripts/macos_artifact.ts"
 RUNTIME_SMOKE="${PACKAGE_ROOT}/scripts/smoke_macos_app.sh"
 TAILSCALE_RESOLVER="${PACKAGE_ROOT}/scripts/resolve_tailscale_cli.sh"
+# Sourced here, before either policy branch, so a missing or unusable guard denies every
+# install rather than only the ones that happen to reach it.
+IDENTITY_MIGRATION_GUARD="${PACKAGE_ROOT}/scripts/enforce_identity_migration.sh"
+[ -f "$IDENTITY_MIGRATION_GUARD" ] && [ ! -L "$IDENTITY_MIGRATION_GUARD" ] || {
+  echo "Packaged identity-migration guard is missing." >&2
+  exit 2
+}
+# shellcheck source=/dev/null
+. "$IDENTITY_MIGRATION_GUARD"
+declare -F recordings_enforce_identity_migration >/dev/null || {
+  echo "Packaged identity-migration guard does not define its enforcement function." >&2
+  exit 2
+}
 if [ "$ARTIFACT_POLICY" = "release" ]; then
   if [ -z "$EXPECTED_TEAM_ID" ]; then
     echo "Release install requires --expected-team-id or RECORDINGS_EXPECTED_TEAM_IDENTIFIER." >&2
@@ -331,13 +413,36 @@ if [ "$ARTIFACT_POLICY" = "release" ]; then
     echo "Local-only acknowledgment cannot be supplied for a release artifact." >&2
     exit 2
   fi
+  if [ "$ALLOW_ADHOC_IDENTITY_MIGRATION" -eq 1 ]; then
+    echo "Ad-hoc identity-migration approval is not valid for a release artifact; use --allow-signing-identity-migration with the exact old/new identity digests." >&2
+    exit 2
+  fi
 else
-  if [ -n "$EXPECTED_TEAM_ID" ]; then
-    echo "Local-only artifacts do not accept --expected-team-id or a release TeamIdentifier environment value." >&2
+  # A local-station artifact may be Developer ID signed under a pinned team, because ad-hoc
+  # signing cannot hold a macOS TCC grant: TCC keys Accessibility to bundle id plus signing
+  # identity, and an ad-hoc CDHash changes on every rebuild, which is what silently killed the
+  # Fn/Globe hold-to-talk CGEventTap. A supplied team must therefore be a real Apple team, and
+  # it is matched against the manifest below exactly as a release team is.
+  if [ -n "$EXPECTED_TEAM_ID" ] && ! [[ "$EXPECTED_TEAM_ID" =~ ^[A-Z0-9]{10}$ ]]; then
+    echo "Local-only --expected-team-id must be a 10-character Developer ID team identifier." >&2
     exit 2
   fi
-  if [ "$APPROVED_TARGET" != "station06" ]; then
-    echo "Local-only install is currently restricted to --approved-target station06." >&2
+  # The approved local-only targets are policy data shared with the artifact tool
+  # and the builder, parsed by one sourced reader so all three agree.
+  LOCAL_TARGET_POLICY="${PACKAGE_ROOT}/scripts/policy/local-only-approved-targets.txt"
+  LOCAL_TARGET_READER="${PACKAGE_ROOT}/scripts/read_local_only_targets.sh"
+  [ -f "$LOCAL_TARGET_READER" ] && [ ! -L "$LOCAL_TARGET_READER" ] || {
+    echo "Packaged local-only approved target reader is missing." >&2
+    exit 2
+  }
+  # shellcheck source=/dev/null
+  . "$LOCAL_TARGET_READER"
+  APPROVED_TARGET_MATCHED=0
+  APPROVED_TARGET_LIST=""
+  read_local_only_targets \
+    "$LOCAL_TARGET_POLICY" APPROVED_TARGET_LIST APPROVED_TARGET_MATCHED "$APPROVED_TARGET" || exit 2
+  if [ "$APPROVED_TARGET_MATCHED" -ne 1 ]; then
+    echo "Local-only install requires an approved --approved-target (${APPROVED_TARGET_LIST})." >&2
     exit 2
   fi
   if ! [[ "$APPROVED_TARGET_IDENTITY_SHA256" =~ ^[a-f0-9]{64}$ ]]; then
@@ -386,12 +491,16 @@ else
     exit 1
   fi
   if [ "$ALLOW_IDENTITY_MIGRATION" -eq 1 ] || [ -n "$EXPECTED_OLD_IDENTITY_SHA256" ] || [ -n "$EXPECTED_NEW_IDENTITY_SHA256" ]; then
-    echo "Release identity-migration flags are not valid for local-only artifacts." >&2
+    echo "Release identity-migration flags are not valid for local-only artifacts; an ad-hoc replacement is approved with --allow-adhoc-identity-migration." >&2
     exit 2
   fi
-  EXPECTED_TEAM_ID="ADHOC"
+  if [ -z "$EXPECTED_TEAM_ID" ]; then
+    EXPECTED_TEAM_ID="ADHOC"
+  fi
   echo "WARNING: installing a non-notarized local-only artifact approved only for ${APPROVED_TARGET}." >&2
-  echo "WARNING: code identity can change; Microphone or Accessibility may require manual reauthorization." >&2
+  if [ "$EXPECTED_TEAM_ID" = "ADHOC" ]; then
+    echo "WARNING: code identity can change; Microphone or Accessibility may require manual reauthorization." >&2
+  fi
 fi
 if [ "$ARTIFACT_POLICY" = "release" ] && [ "$ALLOW_IDENTITY_MIGRATION" -eq 1 ] && \
    { [ -z "$EXPECTED_OLD_IDENTITY_SHA256" ] || [ -z "$EXPECTED_NEW_IDENTITY_SHA256" ]; }; then
@@ -1621,7 +1730,10 @@ if [ "$ARTIFACT_POLICY" = "release" ] && [ -z "$candidate_requirement" ]; then
   exit 1
 fi
 identity_migration=0
-candidate_identity_sha256="$("$BUN_EXECUTABLE" "$ARTIFACT_TOOL" requirement-digest --app "$CANDIDATE_APP" --artifact-policy "$ARTIFACT_POLICY")"
+# Pass the SAME pinned team already given to verify-archive and verify-app. Without it the
+# digest verifies the candidate against the ad-hoc shape, which rejects a correctly
+# Developer-ID-signed local-station bundle and, under `set -euo pipefail`, aborts the install.
+candidate_identity_sha256="$("$BUN_EXECUTABLE" "$ARTIFACT_TOOL" requirement-digest --app "$CANDIDATE_APP" --artifact-policy "$ARTIFACT_POLICY" --expected-team-id "$EXPECTED_TEAM_ID")"
 candidate_tree_sha256="$("$BUN_EXECUTABLE" "$ARTIFACT_TOOL" tree-digest --path "$CANDIDATE_APP")"
 [ "$candidate_identity_sha256" = "$("$BUN_EXECUTABLE" "$ARTIFACT_TOOL" manifest-get \
   --manifest "$MANIFEST_SNAPSHOT" \
@@ -1655,21 +1767,18 @@ for existing_app in ${MANAGEABLE_APPS[@]+"${MANAGEABLE_APPS[@]}"}; do
     identity_migration=1
   fi
 done
-if [ "$ARTIFACT_POLICY" = "release" ] && [ "$identity_migration" -eq 1 ] && [ "$ALLOW_IDENTITY_MIGRATION" -ne 1 ]; then
-  echo "Candidate and existing app designated requirements are not mutually compatible; review the signer change and rerun once with --allow-signing-identity-migration." >&2
-  exit 1
-fi
-if [ "$ARTIFACT_POLICY" = "release" ] && [ "$identity_migration" -eq 1 ] && {
-     [ "$previous_identity_sha256" != "$EXPECTED_OLD_IDENTITY_SHA256" ] ||
-     [ "$candidate_identity_sha256" != "$EXPECTED_NEW_IDENTITY_SHA256" ];
-   }; then
-  echo "Signing identity migration does not match the exact operator-approved old/new identities." >&2
-  exit 1
-fi
-if [ "$ARTIFACT_POLICY" = "release" ] && [ "$identity_migration" -eq 0 ] && [ "$ALLOW_IDENTITY_MIGRATION" -eq 1 ]; then
-  echo "Identity migration approval was supplied but no identity migration is required." >&2
-  exit 1
-fi
+# Enforced for every artifact policy. A local-only artifact is ad-hoc signed, so this is
+# the point at which an install would void the installed app's Microphone and
+# Accessibility grants; the printed warning further down is not a gate.
+recordings_enforce_identity_migration \
+  "$ARTIFACT_POLICY" \
+  "$identity_migration" \
+  "$ALLOW_IDENTITY_MIGRATION" \
+  "$ALLOW_ADHOC_IDENTITY_MIGRATION" \
+  "$previous_identity_sha256" \
+  "$candidate_identity_sha256" \
+  "$EXPECTED_OLD_IDENTITY_SHA256" \
+  "$EXPECTED_NEW_IDENTITY_SHA256" || exit 1
 
 TRANSACTION_DIR="$("$MKTEMP_EXECUTABLE" -d "${APP_PARENT}/.Recordings-transaction.XXXXXX")"
 TRANSACTION_NONCE="$("$BUN_EXECUTABLE" -e 'import { randomUUID } from "node:crypto"; process.stdout.write(randomUUID())')"
@@ -1962,7 +2071,12 @@ fi
 
 if [ "$ARTIFACT_POLICY" = "local_only" ]; then
   echo "Installed local-only Recordings.app for ${APPROVED_TARGET}; this artifact is ad-hoc signed and non-notarized."
-  echo "Microphone or Accessibility may require manual reauthorization after this code-identity change."
+  if [ "$identity_migration" -eq 1 ]; then
+    # Not a maybe: the designated requirement did change, under an explicit approval.
+    echo "Code identity changed under --allow-adhoc-identity-migration; the Microphone and Accessibility grants held by the replaced app no longer apply and must be reauthorized."
+  else
+    echo "Microphone or Accessibility may require manual reauthorization if this code identity differs from the last authorized one."
+  fi
 elif [ "$identity_migration" -eq 1 ]; then
   echo "Installed a new signing identity; macOS will require one-time permission approval for this migration."
 else

package/scripts/macos_artifact.ts

@@ -31,6 +31,7 @@ import {
   unlinkSync,
 } from "node:fs";
 import { tmpdir } from "node:os";
+import { fileURLToPath } from "node:url";
 import { crc32, inflateRawSync } from "node:zlib";
 import {
   nativeFsGuard,
@@ -57,6 +58,97 @@ export const BUNDLE_ID = "com.hasna.recordings";
 export const PROVENANCE_FILENAME = "recordings-build-provenance.json";
 export const RELEASE_APPROVED_TARGET = "fleet";
 export const LEGACY_LOCAL_TARGET_IDENTITY_KIND = "hardware_uuid_sha256";
+export const LOCAL_ONLY_APPROVED_TARGETS_POLICY_PATH = join(
+  dirname(fileURLToPath(import.meta.url)),
+  "policy",
+  "local-only-approved-targets.txt",
+);
+
+// The approved local-only targets are policy data, not code: one file is read by
+// this validator and, through scripts/read_local_only_targets.sh, by both shell entry
+// points, so a target is declared once. The shell reader is a separate implementation
+// of these rules; equivalence is enforced by an executing contract test, not by shared
+// code. Parsing stays deliberately strict — a malformed policy fails closed rather than
+// silently widening the allowlist.
+//
+// This is an operator-integrity control, NOT an authorization boundary. The file sits in
+// the same package root as the guards that read it, so anyone able to edit it can edit
+// those guards. Widening it still grants nothing on its own: the install additionally
+// requires a matching `hostname -s`, a matching authenticated Tailscale node digest, and
+// a matching authenticated manifest SHA-256.
+export function localOnlyApprovedTargets(
+  policyPath: string = LOCAL_ONLY_APPROVED_TARGETS_POLICY_PATH,
+): string[] {
+  // lstat, not readFileSync alone: readFileSync FOLLOWS a symlink, and the shell reader
+  // refuses one outright (`[ -L ]`). That divergence was real and it favoured the
+  // attacker — a policy symlinked at a widened allowlist was rejected by the shell gate
+  // and silently honoured here. Refusing every non-regular file matches the shell reader
+  // and keeps the wording it prints, so both sides fail closed identically.
+  let policyStats;
+  try {
+    policyStats = lstatSync(policyPath);
+  } catch {
+    throw new Error("local-only approved target policy is missing");
+  }
+  if (!policyStats.isFile()) {
+    throw new Error("local-only approved target policy is missing");
+  }
+  // An unreadable (mode 000) policy passes the lstat above and then threw a raw EACCES from
+  // here, while the shell reader emitted bash's own "Permission denied" and no reader
+  // message. Same fail-closed outcome, two unrecognizable errors; both now say this.
+  let rawContents: string;
+  try {
+    rawContents = readFileSync(policyPath, "utf8");
+  } catch {
+    throw new Error("local-only approved target policy is not readable");
+  }
+  // Reject a NUL anywhere, in the same order and with the same wording as the shell
+  // reader's pre-scan. This reader had no NUL check at all and only ever refused one that
+  // happened to land inside a would-be hostname: "# comment\0" was dropped as a comment,
+  // so "# comment\0\nstation03\n" was refused by the shell gate and ACCEPTED here.
+  if (rawContents.includes("\u0000")) {
+    throw new Error("local-only approved target policy contains a NUL byte");
+  }
+  // Strip a BOM at offset 0 only. A U+FEFF anywhere else is a zero-width no-break space,
+  // not a byte-order mark; the shell reader used to strip one per line and therefore
+  // accepted a BOM on line 2 that this reader rejected.
+  const contents = rawContents.replace(/^/, "");
+  const targets = contents
+    .split("\n")
+    // Deliberately NOT String.trim(): trim() also strips U+FEFF and U+00A0, and the
+    // shell reader trims neither, so a trailing NBSP or BOM would be accepted here and
+    // rejected there. ASCII space and tab only, matching read_local_only_targets.sh
+    // under its pinned LC_ALL=C; everything else is left for the hostname shape below.
+    .map((line) => line.replace(/\r$/, "").replace(/^[\t ]+|[\t ]+$/g, ""))
+    .filter((line) => line.length > 0 && !line.startsWith("#"));
+  if (targets.length === 0) {
+    throw new Error("local-only approved target policy lists no targets");
+  }
+  for (const target of targets) {
+    if (!/^[a-z][a-z0-9-]{1,30}[a-z0-9]$/.test(target)) {
+      throw new Error(`local-only approved target policy has an invalid target name: ${target}`);
+    }
+  }
+  if (new Set(targets).size !== targets.length) {
+    throw new Error("local-only approved target policy has duplicate targets");
+  }
+  if (targets.includes(RELEASE_APPROVED_TARGET)) {
+    throw new Error("local-only approved target policy must not list the release fleet target");
+  }
+  return targets;
+}
+
+export function isLocalOnlyApprovedTarget(
+  target: string | undefined,
+  policyPath?: string,
+): boolean {
+  if (target === undefined) return false;
+  return localOnlyApprovedTargets(policyPath).includes(target);
+}
+
+function localOnlyApprovedTargetsMessage(policyPath?: string): string {
+  return localOnlyApprovedTargets(policyPath).join(", ");
+}
 
 export type ArtifactPolicy = "release" | "local_only";
 export type TargetIdentityKind =
@@ -95,7 +187,7 @@ export type MacOSArtifactManifest = BuildProvenance & {
   };
   provenance_sha256: string;
   signing: {
-    mode?: "ad_hoc";
+    mode?: "ad_hoc" | "developer_id";
     authority: string;
     team_id: string;
     trusted_timestamp: string;
@@ -460,14 +552,43 @@ export function parseDesignatedRequirement(output: string): string {
   return requirement;
 }
 
+/**
+ * A local-station artifact is signed one of two ways, and the expected team identifier is
+ * what says which: the sentinel `ADHOC`, or a real 10-character Apple team.
+ *
+ * Developer ID signing exists on this path because ad-hoc signing cannot hold a macOS TCC
+ * grant. TCC keys Accessibility (and Microphone) to bundle id plus signing identity, and an
+ * ad-hoc signature offers only a CDHash that changes on every rebuild, so the hold-to-talk
+ * CGEventTap in FnKeyMonitor.swift lost its permission on each reinstall. Ad-hoc remains
+ * supported for builders that hold no signing key.
+ */
+export function isLocalOnlySigningTeam(expectedTeamId: string): boolean {
+  return expectedTeamId === "ADHOC" || /^[A-Z0-9]{10}$/.test(expectedTeamId);
+}
+
+export function localOnlySigningMode(expectedTeamId: string): "ad_hoc" | "developer_id" {
+  if (expectedTeamId === "ADHOC") return "ad_hoc";
+  if (!/^[A-Z0-9]{10}$/.test(expectedTeamId)) {
+    throw new Error(
+      "local-only Developer ID signing requires ADHOC or a 10-character Apple team identifier",
+    );
+  }
+  return "developer_id";
+}
+
 export function designatedRequirementForPolicy(
   output: string,
   artifactPolicy: ArtifactPolicy,
   adHocSignatureVerified = false,
+  developerIdSignatureVerified = false,
 ): string {
   if (artifactPolicy === "release") return parseDesignatedRequirement(output);
+  // A Developer ID local-station artifact always carries a real designated requirement, and
+  // that requirement is the whole point of signing it: it is the stable identity a TCC grant
+  // attaches to. Never let it degrade to the ad-hoc sentinel.
+  if (developerIdSignatureVerified) return parseDesignatedRequirement(output);
   if (!adHocSignatureVerified) {
-    throw new Error("local-only designated requirement evidence requires verified ad-hoc signing");
+    throw new Error("local-only designated requirement evidence requires verified signing");
   }
   try {
     return parseDesignatedRequirement(output);
@@ -558,11 +679,24 @@ function signingEvidence(
     if (!timestamp || timestamp.toLowerCase() === "none") {
       throw new Error(`${codePath} is missing a trusted signing timestamp`);
     }
+  } else if (localOnlySigningMode(expectedTeamId) === "developer_id") {
+    // Developer ID signed but deliberately NOT notarized: the notarization, single-target
+    // binding and builder attestation are what still separate this from a release. Only the
+    // signing identity is shared, and only because TCC cannot key a durable Accessibility
+    // grant to anything weaker (see localOnlySigningMode).
+    if (!authority.startsWith("Developer ID Application:")) {
+      throw new Error(`${codePath} is not signed by a Developer ID Application authority`);
+    }
+    if (teamId !== expectedTeamId) {
+      throw new Error(`${codePath} TeamIdentifier ${teamId || "missing"} does not match ${expectedTeamId}`);
+    }
+    if (rawSignature.toLowerCase() === "adhoc") {
+      throw new Error(`${codePath} is ad-hoc signed but a Developer ID team was pinned`);
+    }
+    // A trusted timestamp is a release-only claim; local-station builds never pass --timestamp.
+    timestamp = rawTimestamp && rawTimestamp.toLowerCase() !== "none" ? rawTimestamp : "none";
   } else {
     mode = "ad_hoc";
-    if (expectedTeamId !== "ADHOC") {
-      throw new Error("local-only code verification requires the ADHOC signing identity");
-    }
     if (rawSignature.toLowerCase() !== "adhoc" || authority) {
       throw new Error(`${codePath} is not consistently ad-hoc signed for local-only use`);
     }
@@ -587,6 +721,7 @@ function signingEvidence(
     requirementOutput,
     artifactPolicy,
     mode === "ad_hoc",
+    artifactPolicy !== "release" && mode === "developer_id",
   );
   const entitlements = canonicalEntitlements(codePath);
   if (entitlements !== canonicalJson(expectedEntitlements)) {
@@ -1510,7 +1645,7 @@ export function assertManifestShape(manifest: MacOSArtifactManifest): void {
   } else {
     if (
       manifest.artifact_policy !== "local_only" ||
-      manifest.approved_target !== "station06" ||
+      !isLocalOnlyApprovedTarget(manifest.approved_target) ||
       (manifest.approved_target_identity_kind !== undefined &&
         manifest.approved_target_identity_kind !== "tailscale_node_id_sha256") ||
       (manifest.approved_target_identity_kind === undefined) !==
@@ -1523,20 +1658,38 @@ export function assertManifestShape(manifest: MacOSArtifactManifest): void {
       !isHex(manifest.builder_identity_sha256, 64) ||
       manifest.builder_identity_sha256 === manifest.approved_target_identity_sha256
     ) {
-      throw new Error("local-only schema v3 requires exact station06 name and machine identity");
+      throw new Error(
+        "local-only schema v3 requires an approved target name " +
+          `(${localOnlyApprovedTargetsMessage()}) and machine identity`,
+      );
     }
-    if (
-      manifest.non_notarized !== true ||
-      manifest.team_id !== "ADHOC" ||
-      manifest.signing.mode !== "ad_hoc" ||
-      manifest.signing.authority !== "adhoc" ||
-      manifest.signing.helper_authority !== "adhoc" ||
-      manifest.signing.team_id !== "ADHOC" ||
-      manifest.signing.helper_team_id !== "ADHOC" ||
-      manifest.signing.trusted_timestamp !== "none" ||
-      manifest.signing.helper_trusted_timestamp !== "none"
+    // A local-station manifest is internally consistent in exactly one of two shapes: fully
+    // ad-hoc, or fully Developer ID under one pinned team. Mixing them (e.g. a Developer ID
+    // app with an ad-hoc helper) would leave the bundle without one stable identity for TCC
+    // to key on, which is the failure this whole path exists to prevent.
+    if (manifest.non_notarized !== true || !isLocalOnlySigningTeam(manifest.team_id)) {
+      throw new Error("local-only manifest requires a non-notarized ADHOC or Developer ID team");
+    }
+    if (manifest.team_id === "ADHOC") {
+      if (
+        manifest.signing.mode !== "ad_hoc" ||
+        manifest.signing.authority !== "adhoc" ||
+        manifest.signing.helper_authority !== "adhoc" ||
+        manifest.signing.team_id !== "ADHOC" ||
+        manifest.signing.helper_team_id !== "ADHOC" ||
+        manifest.signing.trusted_timestamp !== "none" ||
+        manifest.signing.helper_trusted_timestamp !== "none"
+      ) {
+        throw new Error("local-only manifest requires consistent ad-hoc signing evidence");
+      }
+    } else if (
+      manifest.signing.mode !== "developer_id" ||
+      !manifest.signing.authority.startsWith("Developer ID Application:") ||
+      !manifest.signing.helper_authority.startsWith("Developer ID Application:") ||
+      manifest.signing.team_id !== manifest.team_id ||
+      manifest.signing.helper_team_id !== manifest.team_id
     ) {
-      throw new Error("local-only manifest requires consistent ad-hoc signing evidence");
+      throw new Error("local-only manifest requires consistent Developer ID signing evidence");
     }
     if (
       manifest.notarization.status !== "Not Submitted" ||
@@ -1962,15 +2115,19 @@ function writeProvenance(
       throw new Error("release provenance has an invalid target or Team ID");
     }
   } else if (
-    expectedTeamId !== "ADHOC" ||
-    approvedTarget !== "station06" ||
+    // ADHOC or a pinned Developer ID team; localOnlySigningMode rejects anything else.
+    !isLocalOnlySigningTeam(expectedTeamId) ||
+    !isLocalOnlyApprovedTarget(approvedTarget) ||
     approvedTargetIdentityKind !== "tailscale_node_id_sha256" ||
     builderIdentityKind !== "tailscale_node_id_sha256" ||
     !isHex(approvedTargetIdentitySha256, 64) ||
     !isHex(builderIdentitySha256, 64) ||
     approvedTargetIdentitySha256 === builderIdentitySha256
   ) {
-    throw new Error("new local-only provenance requires ADHOC and a Tailscale node-bound station06 identity");
+    throw new Error(
+      "new local-only provenance requires ADHOC or a pinned Developer ID team and a Tailscale " +
+        `node-bound approved-target identity (${localOnlyApprovedTargetsMessage()})`,
+    );
   } else {
     provenance.artifact_policy = "local_only";
     provenance.approved_target = approvedTarget;
@@ -2120,11 +2277,13 @@ function finalizeLocalArtifact(
   approvedTarget: string,
   approvedTargetIdentityKind: TargetIdentityKind,
   approvedTargetIdentitySha256: string,
+  expectedTeamId: string = "ADHOC",
 ): void {
   assertCurrentSourceRevision(packageRoot, expectedSourceSha);
   if (approvedTargetIdentityKind !== "tailscale_node_id_sha256") {
     throw new Error("new local-only artifacts require a Tailscale node ID identity hash");
   }
+  const localSigningMode = localOnlySigningMode(expectedTeamId);
   const executablePath = join(appPath, "Contents", "MacOS", "Recordings");
   const helperPath = join(appPath, "Contents", "Helpers", "recordings");
   const embeddedPath = provenancePath(appPath);
@@ -2137,26 +2296,26 @@ function finalizeLocalArtifact(
     provenance.approved_target_identity_sha256 !== approvedTargetIdentitySha256 ||
     provenance.builder_identity_kind !== "tailscale_node_id_sha256" ||
     provenance.non_notarized !== true ||
-    provenance.team_id !== "ADHOC"
+    provenance.team_id !== expectedTeamId
   ) {
     throw new Error("embedded provenance is not approved for this local-only target");
   }
   assertExpectedCodeLayout(appPath);
   const outerSigning = signingEvidence(
     appPath,
-    "ADHOC",
+    expectedTeamId,
     APP_ENTITLEMENTS,
     executablePath,
     "local_only",
   );
   const helperSigning = signingEvidence(
     helperPath,
-    "ADHOC",
+    expectedTeamId,
     HELPER_ENTITLEMENTS,
     helperPath,
     "local_only",
   );
-  const items = nestedItems(appPath, "ADHOC", "local_only", outerSigning, helperSigning);
+  const items = nestedItems(appPath, expectedTeamId, "local_only", outerSigning, helperSigning);
   const manifest: MacOSArtifactManifest = {
     ...provenance,
     artifact_type: "recordings-macos-app",
@@ -2164,7 +2323,7 @@ function finalizeLocalArtifact(
     binding: { bundle_tree_sha256: treeDigest(appPath) },
     provenance_sha256: sha256File(embeddedPath),
     signing: {
-      mode: "ad_hoc",
+      mode: localSigningMode,
       authority: outerSigning.authority,
       team_id: outerSigning.teamId,
       trusted_timestamp: outerSigning.timestamp,
@@ -2208,7 +2367,7 @@ function finalizeLocalArtifact(
     appPath,
     archivePath,
     manifest,
-    "ADHOC",
+    expectedTeamId,
     "local_only",
     approvedTarget,
     approvedTargetIdentitySha256,
@@ -2301,11 +2460,19 @@ function assertInstallTransition(
   assertVersionTransition(installedVersion, installedSource, manifest);
 }
 
-function requirementDigest(appPath: string, artifactPolicy: ArtifactPolicy): void {
+function requirementDigest(
+  appPath: string,
+  artifactPolicy: ArtifactPolicy,
+  expectedTeamId: string = "ADHOC",
+): void {
   if (artifactPolicy === "local_only") {
+    // The pinned team decides which local signing shape is verified. Hard-coding "ADHOC" here
+    // rejected every correctly Developer-ID-signed local-station bundle, and because
+    // install_macos_app.sh calls this for EVERY local install under `set -euo pipefail`, that
+    // rejection aborted the install outright — making a properly signed build uninstallable.
     const evidence = signingEvidence(
       appPath,
-      "ADHOC",
+      expectedTeamId,
       APP_ENTITLEMENTS,
       join(appPath, "Contents", "MacOS", "Recordings"),
       "local_only",
@@ -2369,8 +2536,8 @@ function verifyActiveApp(
     const environment: NodeJS.ProcessEnv = {
       HOME: contractHome,
       PATH: "/usr/bin:/bin:/usr/sbin:/sbin",
-      HASNA_RECORDINGS_STORAGE_MODE: "local",
-      RECORDINGS_STORAGE_MODE: "local",
+      HASNA_RECORDINGS_CLIENT_STORE: "sqlite",
+      RECORDINGS_CLIENT_STORE: "sqlite",
       HASNA_RECORDINGS_DB_PATH: join(contractHome, "recordings.db"),
       RECORDINGS_AUDIO_DIR: join(contractHome, "audio"),
     };
@@ -2702,7 +2869,7 @@ function readJournal(path: string): InstallJournal {
         journal.approved_target_identity_sha256 !== "none" ||
         journal.builder_identity_kind !== "none")) ||
     (journal.artifact_policy === "local_only" &&
-      (journal.approved_target !== "station06" ||
+      (!isLocalOnlyApprovedTarget(journal.approved_target) ||
         !isTargetIdentityKind(journal.approved_target_identity_kind) ||
         !isTargetIdentityKind(journal.builder_identity_kind) ||
         journal.approved_target_identity_kind !== journal.builder_identity_kind ||
@@ -5135,6 +5302,7 @@ function main(): void {
       argument("--approved-target"),
       targetIdentityKindArgument(undefined, true),
       argument("--approved-target-identity-sha256"),
+      optionalArgument("--expected-team-id") ?? "ADHOC",
     );
   } else if (command === "verify-archive") {
     const teamId = argument("--team-id");
@@ -5207,7 +5375,11 @@ function main(): void {
       argument("--manifest-sha256"),
     );
   } else if (command === "requirement-digest") {
-    requirementDigest(argument("--app"), artifactPolicyArgument());
+    requirementDigest(
+      argument("--app"),
+      artifactPolicyArgument(),
+      optionalArgument("--expected-team-id") ?? "ADHOC",
+    );
   } else if (command === "tailscale-node-id-sha256") {
     console.log(tailscaleNodeIdSha256(readFileSync(0, "utf8"), argument("--expected-hostname")));
   } else if (command === "verify-filesystem-tree") {