pairling 0.2.0 → 0.2.1

package/payload/mac/companiond/pty_broker_service.py

@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import os
+import signal
+import sys
+import time
+from pathlib import Path
+
+from pty_broker import PTYBrokerManager, ensure_pty_broker_token
+
+
+def _app_support_root() -> Path:
+    raw = os.environ.get("PAIRLING_APP_SUPPORT_ROOT")
+    if raw:
+        return Path(raw).expanduser()
+    return Path.home() / "Library" / "Application Support" / "Pairling"
+
+
+def _runtime_root() -> Path:
+    return Path(__file__).absolute().parent.parent
+
+
+def _source_revision(runtime_root: Path) -> str | None:
+    for path in [runtime_root / "manifest.json", runtime_root / "mac" / "SOURCE_REVISION", runtime_root / "SOURCE_REVISION"]:
+        try:
+            if path.name == "manifest.json":
+                import json
+
+                payload = json.loads(path.read_text(encoding="utf-8"))
+                revision = payload.get("source_revision")
+                return str(revision) if revision else None
+            revision = path.read_text(encoding="utf-8").strip()
+            return revision or None
+        except FileNotFoundError:
+            continue
+        except Exception:
+            continue
+    return None
+
+
+def main() -> int:
+    home = Path.home()
+    companion_dir = home / ".claude" / "companion"
+    terminal_capture_dir = companion_dir / "terminal-capture"
+    token = ensure_pty_broker_token(companion_dir)
+    socket_path = companion_dir / "pty-broker.sock"
+    runtime_root = _runtime_root()
+    manager = PTYBrokerManager(
+        socket_path=socket_path,
+        log_dir=terminal_capture_dir,
+        token=token,
+        runtime_root=runtime_root,
+        script_path=Path(__file__).absolute(),
+        source_revision=_source_revision(runtime_root),
+    )
+
+    stopping = False
+
+    def _handle_signal(signum, _frame) -> None:
+        nonlocal stopping
+        stopping = True
+        print(
+            f"pairling pty broker received {signal.Signals(signum).name}; live PTYs will hang up if the service exits",
+            file=sys.stderr,
+            flush=True,
+        )
+
+    signal.signal(signal.SIGTERM, _handle_signal)
+    signal.signal(signal.SIGINT, _handle_signal)
+
+    print(
+        f"pairling pty broker starting socket={socket_path} app_support={_app_support_root()}",
+        file=sys.stderr,
+        flush=True,
+    )
+    manager.start_attach_server()
+    while not stopping:
+        time.sleep(1.0)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/payload/mac/companiond/runtime_contract.py

@@ -15,8 +15,6 @@ PORT = int(os.environ.get("PAIRLING_RUNTIME_PORT", "7773"))
 LEGACY_PORT = 7723
 DAEMON_LABEL = "dev.pairling.companiond"
 GUARDIAN_LABEL = "dev.pairling.power-guardian"
-LEGACY_DAEMON_LABEL = "com.mghome.notify-webhook"
-LEGACY_GUARDIAN_LABEL = "com.mghome.companion-power-guardian"
 LEGACY_TOKEN_RELATIVE_PATH = ".claude/scripts/.notify-token"
 POWER_STATE_PATH = "/var/run/pairling-power-state.json"
 TAILSCALE_VARIANT = "standalone"

package/payload/mac/companiond/standard_push_publisher.py

@@ -143,6 +143,8 @@ class TurnStateAlertPublisher:
             "last_update": last_update,
             "provider": provider,
             "tool": _bounded_optional(payload.get("tool"), 80),
+            "request_nonce": _bounded_optional(payload.get("request_nonce"), 160),
+            "mac_install_id": _bounded_optional(payload.get("mac_install_id"), 160),
         }
         return {
             "state_key": path.stem,
@@ -211,6 +213,11 @@ class TurnStateAlertPublisher:
             "session_id": native_id,
             "provider": provider,
         })
+        if kind == "action_required":
+            if visible.get("request_nonce"):
+                payload["request_nonce"] = visible.get("request_nonce")
+            if visible.get("mac_install_id"):
+                payload["mac_install_id"] = visible.get("mac_install_id")
         return payload
 
     def _route_session_id_for_event(self, session_id: str) -> str:

package/payload/mac/connectd/cmd/pairling-connectd/authkey_test.go

@@ -0,0 +1,47 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestDefaultAuthKeyTag(t *testing.T) {
+	t.Setenv("PAIRLING_TS_AUTHKEY_TAG", "")
+	if got := defaultAuthKeyTag(); got != "tag:pairling-connect" {
+		t.Fatalf("default tag = %q, want tag:pairling-connect", got)
+	}
+	t.Setenv("PAIRLING_TS_AUTHKEY_TAG", "tag:custom")
+	if got := defaultAuthKeyTag(); got != "tag:custom" {
+		t.Fatalf("override tag = %q, want tag:custom", got)
+	}
+}
+
+func TestLoadTailscaleAuthKeyPrefersEnv(t *testing.T) {
+	dir := t.TempDir()
+	connectdDir := filepath.Join(dir, "connectd")
+	if err := os.MkdirAll(connectdDir, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(connectdDir, "connectd-ts-authkey"), []byte("tskey-auth-from-file\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	t.Setenv("PAIRLING_TS_AUTHKEY", "  tskey-auth-from-env  ")
+	if got := loadTailscaleAuthKey(dir); got != "tskey-auth-from-env" {
+		t.Fatalf("env precedence failed: got %q", got)
+	}
+
+	t.Setenv("PAIRLING_TS_AUTHKEY", "")
+	if got := loadTailscaleAuthKey(dir); got != "tskey-auth-from-file" {
+		t.Fatalf("file fallback failed: got %q", got)
+	}
+}
+
+func TestLoadTailscaleAuthKeyAbsentIsInteractive(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("PAIRLING_TS_AUTHKEY", "")
+	if got := loadTailscaleAuthKey(dir); got != "" {
+		t.Fatalf("expected empty (interactive) when no key present, got %q", got)
+	}
+}

package/payload/mac/connectd/cmd/pairling-connectd/main.go

@@ -47,6 +47,11 @@ func run(args []string) int {
 	controlURL := fs.String("control-url", "", "advanced: custom Tailscale-compatible control server URL")
 	maxBodyBytes := fs.Int64("max-body-bytes", 1_000_000, "maximum proxied request body size")
 	verbose := fs.Bool("verbose", false, "enable verbose tsnet backend logs")
+	// WS1: a tagged auth key (minted from an OAuth client scoped to
+	// tag:pairling-connect) registers this node pre-authorized AND with key
+	// expiry disabled — no 180-day re-auth cliff, no per-node REST call.
+	// Empty keeps the legacy interactive browser-auth path (back-compat).
+	authKeyTag := fs.String("auth-key-tag", defaultAuthKeyTag(), "tag applied to this node when registering with an auth key")
 
 	if err := fs.Parse(args); err != nil {
 		if errors.Is(err, flag.ErrHelp) {
@@ -86,6 +91,18 @@ func run(args []string) int {
 		ControlURL: strings.TrimSpace(*controlURL),
 		UserLogf:   userLogf(statusStore),
 	}
+	// WS1: tagged auth-key registration. A tagged node never expires its key,
+	// eliminating the 180-day re-auth cliff without any Tailscale REST call.
+	if authKey := loadTailscaleAuthKey(appSupport); authKey != "" {
+		srv.AuthKey = authKey
+		if tag := strings.TrimSpace(*authKeyTag); tag != "" {
+			srv.AdvertiseTags = []string{tag}
+		}
+		statusStore.SetAuthKeyMode("tagged")
+		log.Printf("pairling-connectd registering with tagged auth key (tag=%s)", strings.TrimSpace(*authKeyTag))
+	} else {
+		statusStore.SetAuthKeyMode("interactive")
+	}
 	if *verbose {
 		srv.Logf = func(format string, args ...any) {
 			log.Printf("tsnet: "+format, args...)
@@ -146,6 +163,30 @@ func controlURLMode(raw string) string {
 	return status.CustomControlURLMode
 }
 
+// defaultAuthKeyTag is the ACL tag applied to Pairling Connect nodes that
+// register with a tagged auth key. Tagged nodes do not expire their keys.
+func defaultAuthKeyTag() string {
+	if tag := strings.TrimSpace(os.Getenv("PAIRLING_TS_AUTHKEY_TAG")); tag != "" {
+		return tag
+	}
+	return "tag:pairling-connect"
+}
+
+// loadTailscaleAuthKey resolves a tagged auth key, preferring the environment
+// (PAIRLING_TS_AUTHKEY) over a mode-600 credential file under Application
+// Support. Returns "" when neither is present (legacy interactive auth).
+func loadTailscaleAuthKey(appSupport string) string {
+	if key := strings.TrimSpace(os.Getenv("PAIRLING_TS_AUTHKEY")); key != "" {
+		return key
+	}
+	path := filepath.Join(appSupport, "connectd", "connectd-ts-authkey")
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(string(data))
+}
+
 func listenPort(addr string) int {
 	addr = strings.TrimSpace(addr)
 	if addr == "" {

package/payload/mac/connectd/internal/gateway/proxy.go

@@ -503,6 +503,7 @@ var postPaths = map[string]bool{
 	"/phone-tools/result":                    true,
 	"/push/live-activity-test":               true,
 	"/push/live-activity-token":              true,
+	"/push/permission/allow":                 true,
 	"/push/preferences":                      true,
 	"/push/test":                             true,
 	"/resume-session":                        true,

package/payload/mac/connectd/internal/gateway/proxy_test.go

@@ -349,6 +349,7 @@ func TestPrePairModeOnlyAllowsHealthManifestAndClaim(t *testing.T) {
 		{http.MethodPost, "/terminal-control", http.StatusNotFound},
 		{http.MethodPost, "/worker-kill", http.StatusNotFound},
 		{http.MethodPost, "/push/preferences", http.StatusNotFound},
+		{http.MethodPost, "/push/permission/allow", http.StatusNotFound},
 		{http.MethodPost, "/safety/ack", http.StatusNotFound},
 		{http.MethodPost, "/aperture-cli/open", http.StatusNotFound},
 		{http.MethodGet, "/health", http.StatusOK},

package/payload/mac/connectd/internal/runtime/config_test.go

@@ -6,7 +6,7 @@ import (
 )
 
 func TestDefaultStateDirUsesPairlingApplicationSupport(t *testing.T) {
-	home := filepath.Join(string(filepath.Separator), "Users", "mergim")
+	home := filepath.Join(string(filepath.Separator), "Users", "example")
 	got := DefaultStateDir(home)
 	want := filepath.Join(home, "Library", "Application Support", "Pairling", "connectd", "tsnet-state")
 	if got != want {

package/payload/mac/connectd/internal/status/status.go

@@ -43,6 +43,7 @@ type Snapshot struct {
 	TailnetIPCount       int               `json:"tailnet_ip_count"`
 	AuthURLPresent       bool              `json:"auth_url_present"`
 	ControlURLMode       string            `json:"control_url_mode"`
+	AuthKeyMode          string            `json:"auth_key_mode,omitempty"`
 	UpstreamReachable    bool              `json:"upstream_reachable"`
 	ListenerRunning      bool              `json:"listener_running"`
 	GatewayHealthy       bool              `json:"gateway_healthy"`
@@ -88,6 +89,14 @@ func (s *Store) SetControlURLMode(mode string) {
 	})
 }
 
+// SetAuthKeyMode records how this node authenticated: "tagged" (a tagged
+// auth key, key expiry disabled) or "interactive" (the legacy browser flow).
+func (s *Store) SetAuthKeyMode(mode string) {
+	s.update(func(snapshot *Snapshot) {
+		snapshot.AuthKeyMode = mode
+	})
+}
+
 func (s *Store) SetListenPort(port int) {
 	s.update(func(snapshot *Snapshot) {
 		if port <= 0 {

package/payload/mac/install/doctor.sh

@@ -62,7 +62,8 @@ PAIRLING_PORT = int(os.environ.get("PAIRLING_RUNTIME_PORT", "7773"))
 PAIRLING_LABEL = "dev.pairling.companiond"
 PAIRLING_GUARDIAN_LABEL = "dev.pairling.power-guardian"
 PAIRLING_CONNECTD_LABEL = "dev.pairling.connectd"
-LEGACY_LABEL = "com.mghome.notify-webhook"
+PAIRLING_PTYBROKER_LABEL = "dev.pairling.ptybroker"
+TEAM_ID = os.environ.get("PAIRLING_TEAM_ID", os.environ.get("PAIRLING_CONNECTD_TEAM_ID", "965AVD34A3"))
 APP_SUPPORT = Path(os.environ.get("PAIRLING_APP_SUPPORT_ROOT", os.environ.get("COMPANION_APP_SUPPORT_ROOT", str(home / "Library" / "Application Support" / "Pairling"))))
 LOGS_ROOT = Path(os.environ.get("PAIRLING_LOGS_ROOT", os.environ.get("COMPANION_LOGS_ROOT", str(home / "Library" / "Logs" / "Pairling"))))
 CURRENT = APP_SUPPORT / "runtime" / "current"
@@ -75,9 +76,8 @@ USER_PAIRLING = home / ".local" / "bin" / "pairling"
 PAIR_ROOT = APP_SUPPORT / "pair"
 USER_PLIST = home / "Library" / "LaunchAgents" / f"{PAIRLING_LABEL}.plist"
 CONNECTD_USER_PLIST = home / "Library" / "LaunchAgents" / f"{PAIRLING_CONNECTD_LABEL}.plist"
-LEGACY_USER_PLIST = home / "Library" / "LaunchAgents" / f"{LEGACY_LABEL}.plist"
+PTYBROKER_USER_PLIST = home / "Library" / "LaunchAgents" / f"{PAIRLING_PTYBROKER_LABEL}.plist"
 SYSTEM_PLIST = Path("/Library/LaunchDaemons") / f"{PAIRLING_GUARDIAN_LABEL}.plist"
-LEGACY_SYSTEM_PLIST = Path("/Library/LaunchDaemons/com.mghome.companion-power-guardian.plist")
 
 sys.path.insert(0, str(repo_root / "mac" / "companiond"))
 from pairling_connectd_status import fetch_connectd_status, redacted_connectd_summary
@@ -95,6 +95,23 @@ def add(identifier, ok, severity, summary, evidence=None):
     })
 
 
+def codesigning_identity_summary(output: str) -> dict:
+    lines = [line.strip() for line in output.splitlines() if line.strip()]
+    developer_id_lines = [line for line in lines if "Developer ID Application:" in line]
+    expected_team_present = any(f"({TEAM_ID})" in line for line in developer_id_lines)
+    valid_count = None
+    for line in lines:
+        match = re.search(r"(\d+)\s+valid identities found", line)
+        if match:
+            valid_count = int(match.group(1))
+            break
+    return {
+        "valid_identity_count": valid_count,
+        "developer_id_application_count": len(developer_id_lines),
+        "expected_team_present": expected_team_present,
+    }
+
+
 def run(args, timeout=5):
     try:
         proc = subprocess.run(args, capture_output=True, text=True, timeout=timeout)
@@ -202,6 +219,103 @@ def active_pair_records(pair_root: Path) -> list[dict]:
     return records
 
 
+def desired_ptybroker_identity() -> dict:
+    revision = None
+    if manifest and manifest.get("source_revision"):
+        revision = str(manifest.get("source_revision"))
+    elif (CURRENT / "mac" / "SOURCE_REVISION").is_file():
+        try:
+            revision = (CURRENT / "mac" / "SOURCE_REVISION").read_text().strip() or None
+        except Exception:
+            revision = None
+    desired_root = CURRENT.resolve() if CURRENT.exists() else CURRENT
+    return {
+        "runtime_root": str(desired_root),
+        "script_path": str(desired_root / "companiond" / "pty_broker_service.py"),
+        "source_revision": revision,
+        "protocol_version": 1,
+    }
+
+
+def ptybroker_status_rpc() -> tuple[dict | None, str | None]:
+    try:
+        sys.path.insert(0, str(CURRENT / "companiond"))
+        from pty_broker_client import PTYBrokerClient, ensure_pty_broker_token
+
+        companion = home / ".claude" / "companion"
+        client = PTYBrokerClient(companion / "pty-broker.sock", ensure_pty_broker_token(companion), timeout=1.0)
+        status = client.status()
+        return status if isinstance(status, dict) else {}, None
+    except Exception as exc:
+        return None, f"{type(exc).__name__}: {exc}"
+
+
+def ptybroker_deployment_status(*, launchd_loaded: bool) -> dict:
+    desired = desired_ptybroker_identity()
+    base = {
+        "label": PAIRLING_PTYBROKER_LABEL,
+        "state": "unknown",
+        "restart_deferred": False,
+        "pid": None,
+        "live_session_count": None,
+        "live_source_revision": None,
+        "desired_source_revision": desired.get("source_revision"),
+        "desired_runtime_root": desired.get("runtime_root"),
+        "desired_script_path": desired.get("script_path"),
+        "evidence": None,
+    }
+    if not MANIFEST_PATH.is_file() and not CURRENT.exists():
+        return {**base, "state": "not_installed", "evidence": "runtime/current is missing"}
+    if not launchd_loaded:
+        return {**base, "state": "not_running", "evidence": "launchd label is not running"}
+    live, error = ptybroker_status_rpc()
+    if live is None:
+        return {**base, "state": "unreachable_socket", "evidence": error}
+    reasons = []
+    live_root = live.get("runtime_root")
+    if live_root:
+        if os.path.realpath(str(live_root)) != str(desired.get("runtime_root")):
+            reasons.append("runtime_root_mismatch")
+    else:
+        reasons.append("runtime_root_missing")
+    live_script = live.get("script_path")
+    if live_script:
+        if os.path.realpath(str(live_script)) != str(desired.get("script_path")):
+            reasons.append("script_path_mismatch")
+    else:
+        reasons.append("script_path_missing")
+    live_revision = live.get("source_revision")
+    if desired.get("source_revision") and not live_revision:
+        reasons.append("source_revision_missing")
+    elif live_revision and desired.get("source_revision") and str(live_revision) != str(desired.get("source_revision")):
+        reasons.append("source_revision_mismatch")
+    try:
+        live_protocol = int(live.get("protocol_version") or 0)
+    except (TypeError, ValueError):
+        live_protocol = 0
+    if live_protocol != int(desired.get("protocol_version") or 0):
+        if not live.get("protocol_version"):
+            reasons.append("protocol_version_missing")
+        else:
+            reasons.append("protocol_version_mismatch")
+    state = "current" if not reasons else "stale_deferred"
+    return {
+        **base,
+        "state": state,
+        "restart_deferred": state == "stale_deferred",
+        "pid": live.get("pid"),
+        "live_session_count": live.get("live_session_count"),
+        "live_source_revision": live_revision,
+        "live_runtime_root": live_root,
+        "live_script_path": live_script,
+        "protocol_version": live.get("protocol_version"),
+        "code_version": live.get("code_version"),
+        "started_at": live.get("started_at"),
+        "reasons": reasons,
+        "evidence": live,
+    }
+
+
 def first_run_stage(*, installed: bool, running: bool, pair_window_open: bool, remote_ready: bool) -> str:
     if not installed:
         return "helper_missing"
@@ -269,7 +383,13 @@ if manifest:
     runtime = manifest.get("runtime") if isinstance(manifest.get("runtime"), dict) else {}
     add("runtime_port", runtime.get("port") == PAIRLING_PORT, "error", "Runtime port is locked to 7773.", runtime.get("port"))
     launchd = manifest.get("launchd") if isinstance(manifest.get("launchd"), dict) else {}
-    add("launchd_labels", launchd.get("daemon_label") == PAIRLING_LABEL and launchd.get("connectd_label") == PAIRLING_CONNECTD_LABEL and launchd.get("guardian_label") == PAIRLING_GUARDIAN_LABEL, "error", "Manifest launchd labels are Pairling labels.", launchd)
+    launchd_evidence = {
+        "daemon_label": launchd.get("daemon_label"),
+        "ptybroker_label": launchd.get("ptybroker_label"),
+        "connectd_label": launchd.get("connectd_label"),
+        "guardian_label": launchd.get("guardian_label"),
+    }
+    add("launchd_labels", launchd.get("daemon_label") == PAIRLING_LABEL and launchd.get("ptybroker_label") == PAIRLING_PTYBROKER_LABEL and launchd.get("connectd_label") == PAIRLING_CONNECTD_LABEL and launchd.get("guardian_label") == PAIRLING_GUARDIAN_LABEL, "error", "Manifest launchd labels are Pairling labels.", launchd_evidence)
     mismatches = []
     for item in manifest.get("files") or []:
         rel = item.get("path")
@@ -365,7 +485,7 @@ try:
     add(
         "shell_pairling_wrapper",
         "runtime/current/bin/pairling" in pairling_text
-        and "/Users/mergimg0/projects/Pairling" not in pairling_text,
+        and re.search(r"/Users/[^\\s'\"]+/projects/Pairling", pairling_text) is None,
         "error",
         "User pairling command resolves through runtime/current unless PAIRLING_REPO_ROOT is explicitly set.",
         str(USER_PAIRLING),
@@ -411,6 +531,19 @@ except Exception as exc:
     add("connectd_launchagent_plist", False, "error", f"Pairling Connect LaunchAgent plist unreadable: {type(exc).__name__}: {exc}", str(CONNECTD_USER_PLIST))
     add("connectd_launchagent_env", False, "error", "Cannot validate Pairling Connect LaunchAgent environment.", str(CONNECTD_USER_PLIST))
 
+try:
+    payload = load_plist(PTYBROKER_USER_PLIST)
+    args = payload.get("ProgramArguments") or []
+    add(
+        "ptybroker_launchagent_plist",
+        payload.get("Label") == PAIRLING_PTYBROKER_LABEL and any(str(CURRENT / "companiond" / "pty_broker_service.py") == value for value in args),
+        "error",
+        "Pairling PTY broker LaunchAgent points at runtime/current.",
+        {"label": payload.get("Label"), "args": args},
+    )
+except Exception as exc:
+    add("ptybroker_launchagent_plist", False, "error", f"Pairling PTY broker LaunchAgent plist unreadable: {type(exc).__name__}: {exc}", str(PTYBROKER_USER_PLIST))
+
 try:
     payload = load_plist(SYSTEM_PLIST)
     add("guardian_plist", payload.get("Label") == PAIRLING_GUARDIAN_LABEL, "warning", "Pairling guardian LaunchDaemon is rendered/installed.", {"label": payload.get("Label")})
@@ -425,16 +558,23 @@ code, out, err = run(["launchctl", "print", f"gui/{os.getuid()}/{PAIRLING_CONNEC
 add("connectd_launchagent_loaded", code == 0 and "state = running" in out, "error", "Pairling Connect LaunchAgent is running." if code == 0 else "Pairling Connect LaunchAgent is not loaded.", (out or err)[:2000])
 add("connectd_loaded_from_current", str(CURRENT / "connectd" / "pairling-connectd") in out, "error", "Loaded Pairling Connect LaunchAgent uses runtime/current.", out[:2000])
 
-code, out, err = run(["launchctl", "print", f"gui/{os.getuid()}/{LEGACY_LABEL}"])
-legacy_loaded = code == 0 and "state = running" in out
-add("legacy_daemon_unloaded", not legacy_loaded, "error", "Old Pairling predecessor launchd label is not loaded.", (out or err)[:2000])
-add("legacy_launchagent_removed", not LEGACY_USER_PLIST.exists(), "warning", "Legacy user LaunchAgent plist is absent.", str(LEGACY_USER_PLIST))
-add("legacy_guardian_removed", not LEGACY_SYSTEM_PLIST.exists(), "warning", "Legacy guardian LaunchDaemon plist is absent.", str(LEGACY_SYSTEM_PLIST))
+code, out, err = run(["launchctl", "print", f"gui/{os.getuid()}/{PAIRLING_PTYBROKER_LABEL}"])
+ptybroker_launchd_loaded = code == 0 and "state = running" in out
+add("ptybroker_launchagent_loaded", ptybroker_launchd_loaded, "error", "Pairling PTY broker LaunchAgent is running." if code == 0 else "Pairling PTY broker LaunchAgent is not loaded.", (out or err)[:2000])
+add("ptybroker_loaded_from_current", str(CURRENT / "companiond" / "pty_broker_service.py") in out, "error", "Loaded Pairling PTY broker uses runtime/current.", out[:2000])
+ptybroker_deployment = ptybroker_deployment_status(launchd_loaded=ptybroker_launchd_loaded)
+add(
+    "ptybroker_deployment_state",
+    ptybroker_deployment["state"] == "current",
+    "warning",
+    f"Pairling PTY broker deployment state is {ptybroker_deployment['state']}.",
+    ptybroker_deployment,
+)
 
 listeners_7773 = port_listeners(PAIRLING_PORT)
 listeners_7723 = port_listeners(7723)
 add("port_7773_listener", bool(listeners_7773) or tcp_accepts("127.0.0.1", PAIRLING_PORT), "error", "Runtime is listening on 7773.", listeners_7773)
-legacy_conflict = any("notify-webhook" in line or "Python" in line or "python" in line for line in listeners_7723)
+legacy_conflict = any("Python" in line or "python" in line for line in listeners_7723)
 add("legacy_port_7723_clear", not legacy_conflict, "error", "Legacy 7723 daemon is not conflicting.", listeners_7723)
 
 health = None
@@ -475,17 +615,20 @@ for name in ["claude", "codex"]:
 add("provider_clis_detected", True, "warning", "Provider CLI detection completed.", provider_evidence)
 
 release_blockers = []
-developer_id_identity = os.environ.get("PAIRLING_DEVELOPER_ID_IDENTITY", "Developer ID Application: Mergim Gashi (965AVD34A3)")
+developer_id_identity = os.environ.get("PAIRLING_DEVELOPER_ID_IDENTITY")
 code, out, err = run(["/usr/bin/security", "find-identity", "-v", "-p", "codesigning"], timeout=5)
-has_developer_id = code == 0 and developer_id_identity in out
+identity_evidence = codesigning_identity_summary(out)
+has_developer_id = code == 0 and (
+    (developer_id_identity in out) if developer_id_identity else identity_evidence["expected_team_present"]
+)
 if not has_developer_id:
-    release_blockers.append(f"Developer ID identity is missing from the login keychain: {developer_id_identity}")
+    release_blockers.append("Developer ID Application identity is missing from the login keychain for the expected team.")
 add(
     "developer_id_identity",
     has_developer_id,
     "warning",
     "Developer ID Application identity is available for public helper signing.",
-    (out or err)[:2000],
+    identity_evidence if code == 0 else {"error": (err or "security find-identity failed")[:200]},
 )
 
 notary_profile = os.environ.get("PAIRLING_NOTARY_PROFILE", "pairling-notary")
@@ -498,7 +641,7 @@ add(
     has_notary_profile,
     "warning",
     "Notary credentials are stored and can authenticate.",
-    (out or err)[:2000],
+    {"profile": notary_profile, "authenticated": has_notary_profile, "error": None if has_notary_profile else (err or out)[:200]},
 )
 
 # npm distribution: the staged pairling-connectd binary must be a valid
@@ -654,6 +797,7 @@ result = {
         "launchd_label": PAIRLING_LABEL,
         "guardian_label": PAIRLING_GUARDIAN_LABEL,
     },
+    "ptybroker": ptybroker_deployment,
     "paths": {
         "app_support": str(APP_SUPPORT),
         "logs": str(LOGS_ROOT),
@@ -662,9 +806,7 @@ result = {
         "pair_records": str(PAIR_ROOT),
     },
     "legacy": {
-        "daemon_label": LEGACY_LABEL,
         "port": 7723,
-        "loaded": legacy_loaded,
         "listeners": listeners_7723,
     },
     "release_blockers": release_blockers,