jdmbair13m5-changelog-20260923-1025-claude-updater-syspolicyd-autorecovery-resolved

Summary

Upgraded ~/scripts/claude_code_update.zsh from v1.2 to v1.3 fleet-wide across all 6 Mac hosts to remediate recurring syspolicyd deadlocks at _dyld_start during first-execution Gatekeeper evaluation of freshly installed binaries. Automated recovery executes non-interactive sudo -n killall syspolicyd, pauses for launchd daemon respawn, and retries version verification. Formally verified and resolved ticket ISSUE-20260831-19.

Operational Scope

• Hosts: rdmsm4x, rdmbair13m5, rdmbair15m5, rdmpw3265m, rdmpw3275m, jdmbair13m5 (all 6 nodes).
• Files Touched: ~/scripts/claude_code_update.zsh (mode 755).
• Ticket Resolved: ISSUE-20260831-19 (jdmbair13m5: wedged syspolicyd deadlocks exec via AppleSystemPolicy::waitForEvaluation).

Implementation Details

• Root Cause: When brew upgrade --cask claude-code@latest lands a new binary, macOS Gatekeeper evaluates code signature and notarization via AppleSystemPolicy::procNotifyExecComplete -> ASPEvaluationManager::waitOnEvaluation. On multiple fleet hosts (observed on rdmpw3265m, rdmbair15m5, rdmbair13m5 on 2026-09-22, and on jdmbair13m5 on 2026-09-23), syspolicyd wedged with 0% CPU, leaving newly spawned processes asleep indefinitely at _dyld_start.
• Automated Recovery in v1.3:
  • Added recover_syspolicyd() function executing sudo -n killall syspolicyd and pausing 2s for launchd daemon respawn.
  • Bound both pre-upgrade and post-upgrade claude --version checks to auto-trigger recover_syspolicyd() upon timeout (rc == 124) before declaring failure.
  • On successful un-wedging, logs INFO post-upgrade syspolicyd recovery succeeded and appends SYSPOLICYD-UNWEDGED to the result tag.
  • Preserves hard failure logging and diagnostic instructions if syspolicyd fails to clear or timeout persists after restart.

Verification Evidence

1. Local Test Execution on jdmbair13m5:
   • Ran claude_code_update.zsh locally with exit code 0.
   • Appended to /Users/richh/scripts/claude_code_update.log: [2026-09-23 10:23:08 EDT] jdmbair13m5 v1.3 UNCHANGED 2.1.280 -> 2.1.280 (brew rc=0)
2. Fleet-Wide Cryptographic Parity:
   • Artifact SHA-256: c461dcb22d7e2a049c235aef08e8bb0ccdd7546049ea809e498550f2065576da
   • Verified across all 6 nodes:
     • rdmsm4x: c461dcb2...
     • rdmbair13m5: c461dcb2...
     • rdmbair15m5: c461dcb2...
     • rdmpw3265m: c461dcb2...
     • rdmpw3275m: c461dcb2...
     • jdmbair13m5: c461dcb2...
3. Ticket Lifecycle:
   • Acquired lease as agent@jdmbair13m5/8ab6b29b.
   • Resolved ISSUE-20260831-19 in canonical ticket store (rdmsm4x:~/dev/issues).
   • Synced to wiki HTML dashboards on dev.ecs0.net.

Rollback & Undo

To restore v1.2 without auto-recovery:

git checkout af5a4df0e6ba94125f822915ad0a1697628a8ffeae8a05f5867ca8fbd4f76276 -- ~/scripts/claude_code_update.zsh

Or revert commit in fleet configuration management.