jdmbair13m5-changelog-20260923-1027-automation-toggles-reset-and-notes-migration

Session 453a8d57 (claude@jdmbair13m5). 2026-09-23 09:52:57 EDT → 2026-09-23 10:27:21 EDT.

1. Changelogs migrated to the new Notes location

Fleet directive (bus mail 06:13 EDT): Notes changelogs now go to [email protected] → Fleet Changelogs/llmlog.
All 42 local changelogs published there with notes_changelog.zsh v1.3: 42 published, 0 failed. Verified count = 42 (one note per file). Old iCloud/llmlog copies untouched.
Measurement trap: AppleScript truncates note names with "…", so a title/stamp match against name of every note gives false "missing" results. Count with whose name starts with instead.

Cause: 9 kTCCServiceAppleEvents rows for /usr/libexec/sshd-keygen-wrapper were in state "none". These were timed-out SSH-triggered prompts, which render greyed and untoggleable.
macOS 27.2 (26B5091g): the user TCC.db has moved to /private/var/containers/Data/ProtectedSystem/…/TCC.db and is authorization-denied even with FDA, so no scoped edit is possible. tccutil rejects path clients.
Action (Rich approved): tccutil reset AppleEvents, then live re-prompts approved by Rich. Terminal→Notes/Finder/System Events rc 0. ssh→Notes/Finder/Terminal/System Events rc 0.
Casualty: ECSToolHost lost its grant (hardened runtime, no apple-events entitlement).

Commit 0cc6286: ECSToolHost.entitlements, build.sh 1.1.0 (fails closed if the entitlement is missing), NSAppleEventsUsageDescription, build 2. Pushed to fleet + backup. swift test 26/26; universal2 + minos 26.7 gates pass.
Signing not done: over ssh, codesign fails with errSecInternalComponent (login keychain locked in the Background session). Requested from the rdmsm4x peer session "Day-1 installer and Developer ID Application deployment". Tracked in ECSTH-20260923-04 (commit on hub).
TyrellBar has the same gap → ISSUE-20260923-02.

macos-permissions skill: added the macOS 27.2 section (relocated/sealed db, reading state from the SecurityPrivacyExtension log, the tccutil path-client limit, the hardened-runtime casualty check).

ECSToolHost build 2 needs signing in rdmsm4x's Aqua session, then an install on jdmbair13m5 to regain its Automation grant.

Evidence from claude@rdmbair15m5, verified in this host's tccd log:

The global reset was the wrong fix and caused losses. On 27.2, sshd-keygen-wrapper and /bin/zsh are platform binaries ("Platform binary prompting is 'Deny'"), so they are never re-prompted. The reset at 10:18:53 erased 8 sshd-keygen-wrapper + 1 /bin/zsh AppleEvents grants that can't come back through a prompt, plus Rich's 09:55–09:56 ECSToolHost approvals (Notes/Finder/System Events). tccutil list -s AppleEvents now shows only com.apple.Terminal.
The "ssh→X rc 0" verification was a false positive. return name sends no Apple Event. A real count folders over ssh gets rc 124 (no grant, or a pending prompt).
ECSToolHost's entitlement premise was wrong. Build 1 was prompted and granted at 09:55; the check applies to the sender (osascript), not the responsible process. 0cc6286 was reverted (0d7ff80); ECSTH-20260923-04 closed as invalid (85110e4); the fleet stays on identical build-1 bytes. ISSUE-20260923-02 is re-scoped with a correction comment.
Restoring access: claude@rdmbair15m5 is re-firing the ECSToolHost prompts from a herdr pane (needs Rich at the console). Lost platform-binary grants: no known route on 27.2 beyond an MDM PPPC profile.
The macos-permissions skill now says: never run a global reset on 27.2.