@hasna/recordings 0.2.14 → 0.3.2

package/src/native/Recordings/RecordingsTests/RecordingStartTimingTests.swift

@@ -3,29 +3,59 @@ import Foundation
 import Testing
 @testable import RecordingsLib
 
-/// A recorder that starts instantly and records when it was asked to. Lets the production
-/// `startRecording` path run without microphone hardware or TCC grants.
+/// A recorder that starts instantly and records when it was asked to, and that can deliver its
+/// first PCM callback on demand. Lets the production `startRecording` path run without
+/// microphone hardware or TCC grants, including the warm-up window between `start()` returning
+/// and the first sample arriving.
 private final class FakePCMRecorder: PCMRecordingSource, @unchecked Sendable {
     private let lock = NSLock()
     private var startedFlag = false
+    private var stoppedFlag = false
+    private var onPCM: (@Sendable (Data) -> Void)?
 
     var started: Bool {
         lock.withLock { startedFlag }
     }
 
+    /// Whether `stop()` was called. The microphone staying open is the worst outcome of a
+    /// botched teardown — it lights the macOS in-use indicator — so every abandon test asserts
+    /// this.
+    var isStopped: Bool {
+        lock.withLock { stoppedFlag }
+    }
+
+    func attach(onPCM: @escaping @Sendable (Data) -> Void) {
+        lock.withLock { self.onPCM = onPCM }
+    }
+
+    /// Delivers the recorder's first callback the way a real `AVAudioEngine` tap does, roughly
+    /// 100 ms after `start()` has already returned.
+    ///
+    /// `bytes: 0` is a deliberate test seam: it drives the engine's first-chunk promotion —
+    /// which is what the ordering tests below are about — while leaving the stream pipe empty,
+    /// so the pipeline still ends in the deterministic no-audio state instead of writing a WAV
+    /// and shelling out to the CLI. `PCMStreamPipe` skips empty chunks, and the production
+    /// recorder never emits one.
+    func emitFirstChunk(bytes: Int = 0) {
+        let callback = lock.withLock { onPCM }
+        callback?(Data(repeating: 0, count: bytes))
+    }
+
     func start() throws {
         lock.withLock { startedFlag = true }
     }
 
-    func stop() {}
+    func stop() {
+        lock.withLock { stoppedFlag = true }
+    }
 }
 
 @MainActor
 private func makeStartableEngine(
     recorder: FakePCMRecorder,
-    selectionCapture: @escaping @Sendable (pid_t) -> AccessibilitySelectionToken?
+    selectionCapture: @escaping @Sendable (pid_t) -> AccessibilitySelectionToken? = { _ in nil }
 ) -> RecordingEngine {
-    let engine = RecordingEngine()
+    let engine = RecordingEngine(homePath: makeIsolatedTestHome("start-timing-tests"))
     engine.openAIAPIKeyProvider = { "" }
     engine.microphoneAuthorization = { .authorized }
     engine.accessibilityTrustCheck = { true }
@@ -33,10 +63,14 @@ private func makeStartableEngine(
     engine.frontmostAppSnapshot = {
         FrontmostAppSnapshot(pid: 99_999, bundleIdentifier: "com.example.editor", launchDate: Date())
     }
-    engine.recorderFactory = { _ in recorder }
+    engine.recorderFactory = { onPCM in
+        recorder.attach(onPCM: onPCM)
+        return recorder
+    }
     engine.selectionCapture = selectionCapture
     engine.focusedWindowTitleLookup = { _ in nil }
     engine.pasteInterceptorForTesting = { _, _, _ in }
+    engine.commandCLI = { _, _, _ in "ERROR: command CLI must not run in this test" }
     return engine
 }
 
@@ -53,10 +87,50 @@ private func waitUntil(
     return condition()
 }
 
+/// Drives the capture to live the way the recorder does, and waits for the MainActor hop that
+/// promotes it.
+@MainActor
+private func confirmCapture(_ engine: RecordingEngine, _ recorder: FakePCMRecorder) async -> Bool {
+    recorder.emitFirstChunk()
+    return await waitUntil { engine.isRecording }
+}
+
+/// Full teardown checklist for an abandoned attempt. Kept in one place because a partial
+/// assertion here is indistinguishable from a pass: an abandon that forgets `recorder.stop()`
+/// leaves the microphone open with the macOS indicator lit, and one that forgets
+/// `isWarmingUpCapture = false` wedges the engine so the start gate refuses every later press.
+@MainActor
+private func expectFullyTornDown(
+    _ engine: RecordingEngine,
+    _ recorder: FakePCMRecorder,
+    sourceLocation: SourceLocation = #_sourceLocation
+) {
+    #expect(recorder.isStopped, "the microphone must be released, not left open", sourceLocation: sourceLocation)
+    #expect(!engine.isWarmingUpCapture, "a warming flag left set wedges the start gate", sourceLocation: sourceLocation)
+    #expect(!engine.isRecording, sourceLocation: sourceLocation)
+    #expect(!engine.captureIsActive, sourceLocation: sourceLocation)
+    #expect(!engine.isTranscribing, "an empty buffer must never enter the transcription pipeline", sourceLocation: sourceLocation)
+    #expect(engine.canStartRecording, "the engine must be immediately ready to try again", sourceLocation: sourceLocation)
+}
+
+/// The disclosure an empty attempt owes the user. Asserted on `blockedReason` rather than
+/// `statusMessage` alone: only `blockedReason` reaches the always-visible menu-bar glyph, and
+/// `statusMessage` is rewritten on every return to idle.
+@MainActor
+private func expectEmptyAttemptDisclosed(
+    _ engine: RecordingEngine,
+    _ alert: RecordingAttemptAlert,
+    sourceLocation: SourceLocation = #_sourceLocation
+) {
+    #expect(engine.blockedReason == alert.message, "the outcome must reach the always-on surface", sourceLocation: sourceLocation)
+    #expect(engine.statusMessage == alert.message, sourceLocation: sourceLocation)
+    #expect(engine.canStartRecording, "a disclosure must not disable Start", sourceLocation: sourceLocation)
+}
+
 @MainActor
 struct RecordingStartTimingTests {
     @Test("the recorder starts on keydown even while the AX selection capture is blocked")
-    func recorderStartDoesNotWaitOnSelectionCapture() {
+    func recorderStartDoesNotWaitOnSelectionCapture() async {
         let captureGate = DispatchSemaphore(value: 0)
         let recorder = FakePCMRecorder()
         let engine = makeStartableEngine(recorder: recorder) { _ in
@@ -72,9 +146,13 @@ struct RecordingStartTimingTests {
         // ordering the recorder is live before the capture has produced anything.
         engine.startRecording(trigger: .manual)
         #expect(recorder.started, "recorder must start while AX capture is still pending")
-        #expect(engine.isRecording)
+        #expect(engine.isWarmingUpCapture, "start() returning is warm-up, not captured audio")
+        #expect(engine.captureIsActive)
         #expect(engine.flowPhase == .listening)
 
+        #expect(await confirmCapture(engine, recorder))
+        #expect(!engine.isWarmingUpCapture)
+
         captureGate.signal()
         engine.cancelRecording()
         #expect(engine.flowPhase == .idle)
@@ -90,7 +168,7 @@ struct RecordingStartTimingTests {
         }
 
         engine.startRecording(trigger: .manual)
-        #expect(engine.isRecording)
+        #expect(await confirmCapture(engine, recorder))
         engine.stopAndTranscribe()
         #expect(engine.isTranscribing)
 
@@ -111,7 +189,7 @@ struct RecordingStartTimingTests {
     }
 
     @Test("a released key before the capture resolves still cancels cleanly")
-    func cancelDuringPendingCapture() {
+    func cancelDuringPendingCapture() async {
         let captureGate = DispatchSemaphore(value: 0)
         let recorder = FakePCMRecorder()
         let engine = makeStartableEngine(recorder: recorder) { _ in
@@ -119,7 +197,7 @@ struct RecordingStartTimingTests {
             return nil
         }
         engine.startRecording(trigger: .manual)
-        #expect(engine.isRecording)
+        #expect(await confirmCapture(engine, recorder))
         engine.cancelRecording()
         #expect(!engine.isRecording)
         #expect(engine.flowPhase == .idle)
@@ -127,3 +205,121 @@ struct RecordingStartTimingTests {
         #expect(engine.canStartRecording)
     }
 }
+
+/// The defect this suite exists for: `recorder.start()` returns roughly 100 ms before the
+/// microphone delivers a sample, so a trigger released inside that window captured nothing at
+/// all. The engine already had the right branch for it — "released before recording started;
+/// cancelling pending start" — and it was simply unreachable, because `isRecording` flipped on
+/// `start()` returning. A 539 ms hold on the owner's machine missed the branch by 20 ms and ran
+/// the whole transcription pipeline over an empty buffer, silently.
+@MainActor
+struct RecordingCaptureWarmUpTests {
+    @Test("a trigger released between recorder start and the first PCM chunk cancels instead of transcribing")
+    func releaseDuringWarmUpCancelsInsteadOfTranscribing() {
+        let recorder = FakePCMRecorder()
+        let engine = makeStartableEngine(recorder: recorder)
+
+        engine.startRecording(trigger: .fnKey)
+        #expect(recorder.started)
+        #expect(engine.isWarmingUpCapture)
+        #expect(!engine.isRecording, "no audio has arrived, so nothing is being recorded yet")
+
+        engine.handleTriggerRelease(.fnKey)
+
+        expectFullyTornDown(engine, recorder)
+        expectEmptyAttemptDisclosed(engine, .releasedBeforeAudio)
+    }
+
+    @Test("the configurable shortcut takes the same path as fn")
+    func releaseDuringWarmUpCancelsForTheKeyboardShortcut() {
+        let recorder = FakePCMRecorder()
+        let engine = makeStartableEngine(recorder: recorder)
+
+        engine.startRecording(trigger: .keyboardShortcut)
+        #expect(engine.isWarmingUpCapture)
+        engine.handleTriggerRelease(.keyboardShortcut)
+
+        expectFullyTornDown(engine, recorder)
+        expectEmptyAttemptDisclosed(engine, .releasedBeforeAudio)
+    }
+
+    @Test("a release after the first PCM chunk transcribes as before")
+    func releaseAfterFirstChunkTranscribes() async {
+        let recorder = FakePCMRecorder()
+        let engine = makeStartableEngine(recorder: recorder)
+
+        engine.startRecording(trigger: .fnKey)
+        #expect(await confirmCapture(engine, recorder))
+        #expect(!engine.isWarmingUpCapture)
+
+        engine.handleTriggerRelease(.fnKey)
+        #expect(engine.isTranscribing, "audio existed, so the pipeline must run")
+        #expect(engine.blockedReason == nil, "a recording that captured audio discloses nothing")
+    }
+
+    @Test("a PCM chunk that lands after the attempt was abandoned cannot resurrect it")
+    func lateChunkCannotResurrectAnAbandonedAttempt() async {
+        let recorder = FakePCMRecorder()
+        let engine = makeStartableEngine(recorder: recorder)
+
+        engine.startRecording(trigger: .fnKey)
+        engine.handleTriggerRelease(.fnKey)
+        expectFullyTornDown(engine, recorder)
+
+        // The recorder's delivery queue can still hand over a buffer that was in flight when
+        // the tap was torn down.
+        recorder.emitFirstChunk()
+        try? await Task.sleep(for: .milliseconds(150))
+
+        expectFullyTornDown(engine, recorder)
+    }
+
+    @Test("Stop clicked during warm-up abandons instead of transcribing silence")
+    func stopDuringWarmUpAbandons() {
+        let recorder = FakePCMRecorder()
+        let engine = makeStartableEngine(recorder: recorder)
+
+        engine.startRecording(trigger: .manual)
+        #expect(engine.isWarmingUpCapture)
+        engine.stopAndTranscribe()
+
+        expectFullyTornDown(engine, recorder)
+        expectEmptyAttemptDisclosed(engine, .releasedBeforeAudio)
+    }
+
+    @Test("Discard during warm-up tears down without raising an alert the user does not need")
+    func discardDuringWarmUpIsSilent() {
+        let recorder = FakePCMRecorder()
+        let engine = makeStartableEngine(recorder: recorder)
+
+        engine.startRecording(trigger: .manual)
+        engine.cancelRecording()
+
+        expectFullyTornDown(engine, recorder)
+        #expect(engine.blockedReason == nil, "the user asked for the discard; do not alarm them")
+        #expect(engine.flowPhase == .idle)
+        #expect(engine.statusMessage == "Ready")
+    }
+
+    @Test("warm-up blocks a second start, and a new start clears the previous alert")
+    func warmUpBlocksASecondStartAndANewStartClearsTheAlert() {
+        let recorder = FakePCMRecorder()
+        let engine = makeStartableEngine(recorder: recorder)
+
+        engine.startRecording(trigger: .manual)
+        #expect(engine.isWarmingUpCapture)
+        #expect(!engine.canStartRecording, "the surface must not offer Start during warm-up")
+        #expect(!RecordingEngine.canBeginRecording(
+            isRecording: false,
+            isTranscribing: false,
+            isWarmingUpCapture: true
+        ))
+
+        // `.manual` has no key to release; Stop is the only way out of a warming manual start.
+        engine.stopAndTranscribe()
+        expectEmptyAttemptDisclosed(engine, .releasedBeforeAudio)
+
+        engine.startRecording(trigger: .manual)
+        #expect(engine.blockedReason == nil, "a live recording must not sit under a stale disclosure")
+    }
+}

package/src/native/Recordings/RecordingsTests/SpeechIntentTests.swift

@@ -481,40 +481,51 @@ struct IntentFlowStateTests {
 
     @Test("delivery only runs ahead of persistence for locally-screened plain dictation")
     func pasteBeforePersistenceIsRouteAware() {
+        // `enhanceTriggersJSON` has no default by design (review F2 on #30): "[]" decodes to
+        // "no configured triggers" and would fail OPEN for a caller that omitted it. These five
+        // cases are all `off`/`always`, where the screen is never consulted, so they state the
+        // empty list explicitly rather than relying on an absent default.
         // Plain dictation with cleanup off: paste first, persist milliseconds later.
         #expect(RecordingEngine.shouldPasteBeforePersistence(
             postProcessingMode: PostProcessingMode.off.rawValue,
             transcript: "meet me at noon by the north entrance",
             hasSelection: false,
-            intentDetectionEnabled: true
+            intentDetectionEnabled: true,
+            enhanceTriggersJSON: "[]"
         ))
         // Command-shaped speech with a selection may become a rewrite — persist first.
         #expect(!RecordingEngine.shouldPasteBeforePersistence(
             postProcessingMode: PostProcessingMode.off.rawValue,
             transcript: "rewrite this to be more formal",
             hasSelection: true,
-            intentDetectionEnabled: true
+            intentDetectionEnabled: true,
+            enhanceTriggersJSON: "[]"
         ))
         // Question-shaped speech may become a conversation — persist first.
         #expect(!RecordingEngine.shouldPasteBeforePersistence(
             postProcessingMode: PostProcessingMode.off.rawValue,
             transcript: "what's the capital of France?",
             hasSelection: false,
-            intentDetectionEnabled: true
+            intentDetectionEnabled: true,
+            enhanceTriggersJSON: "[]"
         ))
         // Detection off restores pure dictation: always paste first when cleanup is off.
         #expect(RecordingEngine.shouldPasteBeforePersistence(
             postProcessingMode: PostProcessingMode.off.rawValue,
             transcript: "what's the capital of France?",
             hasSelection: false,
-            intentDetectionEnabled: false
+            intentDetectionEnabled: false,
+            enhanceTriggersJSON: "[]"
         ))
-        // Any cleanup mode other than off always persists first.
+        // `always` mode persists first whatever the transcript looks like. This used to read "any
+        // cleanup mode other than off", which this PR makes false: `auto` now pastes first when
+        // EnhancementScreen proves the helper cannot rewrite the text.
         #expect(!RecordingEngine.shouldPasteBeforePersistence(
             postProcessingMode: PostProcessingMode.always.rawValue,
             transcript: "meet me at noon",
             hasSelection: false,
-            intentDetectionEnabled: true
+            intentDetectionEnabled: true,
+            enhanceTriggersJSON: "[]"
         ))
     }
 

package/src/native/Recordings/RecordingsTests/TestHomeDirectory.swift

@@ -0,0 +1,23 @@
+import Foundation
+
+/// A throwaway `~` for one `RecordingEngine` under test.
+///
+/// `RecordingEngine` roots everything it owns at `<home>/.hasna/recordings`: the audio spool,
+/// `config.json` (which holds the operator's live API keys), and `Recordings.log`. Its
+/// `homePath` default is the real home, so before that seam existed every engine a test built
+/// wrote there — on 2026-07-27 a suite run appended 11 fixture lines
+/// (`target=com.example.editor pid=99999`, `accessibility=false`) to the log of a machine the
+/// owner dictates on, corrupting the only record the recording investigations read, and
+/// rewrote that machine's real `config.json`.
+///
+/// Same shape as `NativeAppDiagnosticsTests.makeHome()`, the existing precedent for a temp
+/// home behind a `homePath:` parameter: a fresh `$TMPDIR` directory per call. It is left for
+/// the OS to reap rather than torn down, because the callers are engine factories that hand
+/// back only the engine and so have no scope to remove it from; `CLIRunnerTests` instead
+/// passes the temp home it already creates and already deletes.
+func makeIsolatedTestHome(_ label: String) -> String {
+    let url = FileManager.default.temporaryDirectory
+        .appendingPathComponent("recordings-\(label)-\(UUID().uuidString)")
+    try? FileManager.default.createDirectory(at: url, withIntermediateDirectories: true)
+    return url.path
+}

package/src/native/Recordings/Updater/Broker/ApplicationProcessQuiescence.swift

@@ -3,6 +3,12 @@ import Foundation
 import RecordingsUpdateProtocol
 
 enum ApplicationProcessQuiescence {
+    /// `<sys/proc_info.h>` defines `PROC_PIDPATHINFO_MAXSIZE` as `(4 * MAXPATHLEN)`. Swift's
+    /// ClangImporter imports the libproc *functions* but not compound macro expressions, so
+    /// the value is restated here. `proc_pidpath` rejects a buffer larger than this, so it
+    /// must track the header rather than being rounded up to a convenient power of two.
+    private static let processPathBufferSize = 4 * Int(MAXPATHLEN)
+
     /// Reject activation while any executable loaded from the live bundle is still
     /// running. The one authenticated update client servicing this XPC request is
     /// exempt only when its kernel-reported executable path is the fixed client path.
@@ -20,7 +26,7 @@ enum ApplicationProcessQuiescence {
         let authenticatedClientPath = RecordingsUpdateConstants.applicationPath + "/"
             + RecordingsUpdateConstants.updateClientRelativePath
         for processIdentifier in processIdentifiers.prefix(Int(count)) where processIdentifier > 0 {
-            var pathBytes = [CChar](repeating: 0, count: Int(PROC_PIDPATHINFO_MAXSIZE))
+            var pathBytes = [CChar](repeating: 0, count: Self.processPathBufferSize)
             let pathLength = pathBytes.withUnsafeMutableBufferPointer { buffer in
                 proc_pidpath(
                     processIdentifier,

package/src/native/Recordings/Updater/Broker/AtomicActivation.swift

@@ -25,16 +25,16 @@ struct AtomicActivator {
         let applicationPath = RecordingsUpdateConstants.applicationPath
         let previousPath = stagedUpdate.directory + "/previous.app"
         let failedCandidatePath = stagedUpdate.directory + "/failed-candidate.app"
-        let previousDigest = try digestIfPresent(applicationPath)
-        let candidateMode = try applicationMode(candidatePath)
-        let previousMode = previousDigest == nil ? nil : try applicationMode(applicationPath)
-        let candidateExecutableModes = try applicationExecutableModes(candidatePath)
+        let previousDigest = try Self.digestIfPresent(applicationPath)
+        let candidateMode = try Self.applicationMode(candidatePath)
+        let previousMode = previousDigest == nil ? nil : try Self.applicationMode(applicationPath)
+        let candidateExecutableModes = try Self.applicationExecutableModes(candidatePath)
         let previousExecutableModes = previousDigest == nil
             ? nil
-            : try applicationExecutableModes(applicationPath)
-        guard try digestIfPresent(candidatePath) == payload.candidateTreeSHA256,
-              try digestIfPresent(previousPath) == nil,
-              try digestIfPresent(failedCandidatePath) == nil
+            : try Self.applicationExecutableModes(applicationPath)
+        guard try Self.digestIfPresent(candidatePath) == payload.candidateTreeSHA256,
+              try Self.digestIfPresent(previousPath) == nil,
+              try Self.digestIfPresent(failedCandidatePath) == nil
         else {
             throw AtomicActivationError.invalidPreparedState
         }
@@ -83,7 +83,7 @@ struct AtomicActivator {
               journal.cohortPackageSHA256 == payload.packageSHA256,
               journal.candidateTreeSHA256 == payload.candidateTreeSHA256,
               journal.minimumOSVersion == payload.minimumOSVersion,
-              journal.envelopePayloadSHA256 == envelopeDigest(payload)
+              journal.envelopePayloadSHA256 == (try envelopeDigest(payload))
         else {
             throw AtomicActivationError.recoveryRequired
         }
@@ -171,7 +171,7 @@ struct AtomicActivator {
             journal.phase = "launch-barrier-releasing"
             try durableJournal.write(journal)
             try namespace.releaseCommittedLaunchBarrier(journal: journal)
-            try Self.requireCommittedNamespaceState(journal)
+            try Self.requireCommittedNamespaceState(journal: journal)
             journal.phase = "launch-barrier-released"
             try durableJournal.write(journal)
             journal.phase = "activated"

package/src/native/Recordings/Updater/Broker/BrokerMain.swift

@@ -144,7 +144,7 @@ final class UpdateBrokerSession: NSObject, RecordingsUpdateXPCProtocol {
                 envelope: envelope
             )
             do {
-                let result = try performStagedInstall(staged: staged, policy: policy)
+                let result = try performStagedInstall(staged: staged, peer: peer, policy: policy)
                 try cleanupIfTerminalOrUnjournaled(staged: staged, rootState: rootState)
                 return result
             } catch {
@@ -166,6 +166,10 @@ final class UpdateBrokerSession: NSObject, RecordingsUpdateXPCProtocol {
 
     private static func performStagedInstall(
         staged: StagedUpdate,
+        // The activation quiescence gate must exempt exactly the one authenticated client
+        // servicing this request, so the verified peer has to reach it rather than being
+        // re-derived here.
+        peer: AuthenticatedPeer,
         policy: BrokerPolicy
     ) throws -> NSDictionary {
         guard let envelopeData = staged.envelope.data,

package/src/native/Recordings/Updater/Broker/HostOSProductVersion.swift

@@ -1,4 +1,5 @@
 import Foundation
+import RecordingsUpdateProtocol
 
 enum HostOSProductVersionQueryError: Error {
     case unavailable

package/src/native/Recordings/Updater/Broker/PeerIdentity.swift

@@ -149,11 +149,56 @@ enum RootTrustStore {
     }
 }
 
+/// PRIVATE API, DELIBERATE — RISK ACCEPTED.
+///
+/// The peer's audit token is the only race-free identity for an XPC connection: it names the
+/// exact process that opened the connection, whereas a PID can be reused between the time
+/// the kernel reports it and the time we resolve its code signature. `NSXPCConnection`
+/// exposes `-auditToken` in the runtime but declares it in no public header (the public
+/// header offers only `processIdentifier`, `effectiveUserIdentifier` and
+/// `auditSessionIdentifier`), so this declaration is the only contract we have and Apple may
+/// change or remove it in any macOS update.
+///
+/// Two things keep that risk bounded, and both must stay:
+///   1. `authenticate` checks `responds(to:)` before casting, so a macOS that REMOVES the property
+///      makes peer authentication throw rather than read a garbage struct. That is the limit of what
+///      guard 1 proves: it establishes only that a selector of that name exists, and says nothing
+///      about its return type, so a macOS that CHANGED the return type would pass it.
+///   2. `authenticate` cross-checks the token's PID and EUID against the *public*
+///      `processIdentifier` and `effectiveUserIdentifier`. This is the guard that catches ABI drift,
+///      including the changed-return-type case guard 1 cannot see: a layout that no longer decodes to
+///      the same process disagrees with the public properties and is rejected, so the failure mode is
+///      a refused peer, never a mis-identified one.
+///
+/// The `@objc` attribute below is load-bearing. Without it the protocol carries no Objective-C
+/// witness and the `unsafeBitCast` still compiles, but the first authentication traps instead of
+/// dispatching to the real getter. Pinned by native-updater-broker-contract.test.ts.
+///
+/// The supported long-term replacement is `-[NSXPCListener setConnectionCodeSigningRequirement:]`
+/// (macOS 13+), which moves requirement enforcement into XPC itself. Migrating is tracked
+/// separately because this code also reads signing flags and entitlements back off the
+/// resolved `SecCode`, which that API does not provide.
+@objc private protocol XPCConnectionAuditTokenProviding {
+    var auditToken: audit_token_t { get }
+}
+
 struct PeerIdentityPolicy {
     let policy: BrokerPolicy
 
     func authenticate(_ connection: NSXPCConnection) throws -> AuthenticatedPeer {
-        var token = connection.auditToken
+        // See XPCConnectionAuditTokenProviding: fail closed if the private property is gone
+        // instead of reinterpreting whatever the cast would land on.
+        guard connection.responds(to: NSSelectorFromString("auditToken")) else {
+            throw BrokerSecurityError.peerAuditTokenUnavailable
+        }
+        var token = unsafeBitCast(connection, to: XPCConnectionAuditTokenProviding.self).auditToken
+        // The audit token is authoritative, but it must agree with the two public
+        // properties. Disagreement means the private ABI moved under us; refuse the peer.
+        guard audit_token_to_pid(token) == connection.processIdentifier,
+              audit_token_to_euid(token) == connection.effectiveUserIdentifier
+        else {
+            throw BrokerSecurityError.peerAuditTokenUnavailable
+        }
         let tokenData = withUnsafeBytes(of: &token) { Data($0) }
         let attributes = [kSecGuestAttributeAudit as String: tokenData] as CFDictionary
         var guest: SecCode?
@@ -191,8 +236,13 @@ struct PeerIdentityPolicy {
         }
 
         var signingInformation: CFDictionary?
+        // `SecCodeCopySigningInformation` is typed against `SecStaticCode`. In C a
+        // `SecCodeRef` is accepted directly (a dynamic code is a static code plus running
+        // state) but Swift imports the two as unrelated CF types, so the relationship has
+        // to be restated. This is a representation cast only — no ownership transfer.
+        let staticGuest = unsafeBitCast(guest, to: SecStaticCode.self)
         let informationStatus = SecCodeCopySigningInformation(
-            guest,
+            staticGuest,
             SecCSFlags(rawValue: kSecCSSigningInformation | kSecCSRequirementInformation),
             &signingInformation
         )
@@ -229,7 +279,10 @@ struct PeerIdentityPolicy {
         guard let flags = information[kSecCodeInfoFlags as String] as? NSNumber else {
             return false
         }
-        return flags.uint32Value & UInt32(kSecCodeSignatureRuntime) != 0
+        // `kSecCodeSignatureRuntime` is a member of the `CF_OPTIONS(uint32_t,
+        // SecCodeSignatureFlags)` set in CSCommon.h, so Swift exposes it as
+        // `SecCodeSignatureFlags.runtime` and not as a bare `kSec…` global.
+        return flags.uint32Value & SecCodeSignatureFlags.runtime.rawValue != 0
     }
 
     private static func hasNoDangerousDebugOrLoaderEntitlements(
@@ -259,6 +312,7 @@ enum BrokerSecurityError: Error, CustomStringConvertible {
     case invalidPolicy(String)
     case invalidTrustFile
     case peerCodeUnavailable(OSStatus)
+    case peerAuditTokenUnavailable
     case peerRejected(OSStatus)
     case peerMetadataRejected
 
@@ -267,6 +321,8 @@ enum BrokerSecurityError: Error, CustomStringConvertible {
         case let .invalidPolicy(reason): "Invalid root-owned broker policy: \(reason)"
         case .invalidTrustFile: "A root-owned broker trust file is missing or unsafe"
         case let .peerCodeUnavailable(status): "Could not resolve the XPC peer code identity (\(status))"
+        case .peerAuditTokenUnavailable:
+            "Could not read a trustworthy audit token for the XPC peer"
         case let .peerRejected(status): "The XPC peer code identity was rejected (\(status))"
         case .peerMetadataRejected: "The XPC peer signing metadata was rejected"
         }

package/src/native/Recordings/Updater/Protocol/UpdateProtocol.swift

@@ -102,17 +102,36 @@ public protocol RecordingsUpdateXPCProtocol {
     func queryStatus(withReply reply: @escaping (NSDictionary) -> Void)
 }
 
+/// Builds the secure-coding allowlist that `NSXPCInterface` expects for one argument.
+///
+/// `-[NSXPCInterface setClasses:forSelector:argumentIndex:ofReply:]` takes an
+/// `NSSet<Class>`, which Swift imports as `Set<AnyHashable>` because Objective-C class
+/// objects do not conform to Swift's `Hashable`. A set literal of metatypes therefore
+/// does not type-check, and the members must stay *class objects*: XPC reads each one
+/// as a `Class`. Satisfying the type checker some other way is not a workaround —
+/// `AnyHashable(ObjectIdentifier(cls))` compiles but yields a set in which no member is
+/// a class, which crashes inside `setClasses`. Bridging an `NSSet` of the class objects
+/// is the only shape that both compiles and preserves the intended allowlist.
+private func xpcAllowedClasses(_ classes: [AnyClass]) -> Set<AnyHashable> {
+    guard let allowed = NSSet(array: classes) as? Set<AnyHashable> else {
+        // Fail closed rather than install a widened or empty allowlist on the
+        // privileged updater interface.
+        preconditionFailure("NSXPCInterface class allowlist failed to bridge from NSSet")
+    }
+    return allowed
+}
+
 /// XPC decoding is intentionally limited to retained file handles on request and
 /// scalar dictionaries on reply. No path-bearing or arbitrary option object is accepted.
 public func makeRecordingsUpdateXPCInterface() -> NSXPCInterface {
     let interface = NSXPCInterface(with: RecordingsUpdateXPCProtocol.self)
     let installSelector = NSSelectorFromString("installWithArchive:manifest:envelope:reply:")
     let statusSelector = NSSelectorFromString("queryStatusWithReply:")
-    let fileHandleClasses: Set<AnyHashable> = [FileHandle.self]
+    let fileHandleClasses = xpcAllowedClasses([FileHandle.self])
     for index in 0..<3 {
         interface.setClasses(fileHandleClasses, for: installSelector, argumentIndex: index, ofReply: false)
     }
-    let replyClasses: Set<AnyHashable> = [NSDictionary.self, NSString.self, NSNumber.self]
+    let replyClasses = xpcAllowedClasses([NSDictionary.self, NSString.self, NSNumber.self])
     interface.setClasses(replyClasses, for: installSelector, argumentIndex: 0, ofReply: true)
     interface.setClasses(replyClasses, for: statusSelector, argumentIndex: 0, ofReply: true)
     return interface