rdmbair15m5-changelog-20260831-1755-fleet-desktop-permissions-ard-audit

Summary

Audited and configured macOS remote desktop control, screen viewing privileges, AuthorizationDB taskport rights, Developer Mode, Application Firewall rules, and TCC permissions across all 6 fleet hosts (rdmsm4x, rdmbair13m5, rdmbair15m5, rdmpw3265m, rdmpw3275m, jdmbair13m5).

Actions Taken

1. Synchronized Fleet Scripts:
   • Deployed preauthorize_dev_permissions.zsh and audit_tcc_llm_permissions_v1.0.py to jdmbair13m5 and rdmbair13m5.
2. Developer & Taskport Pre-authorization:
   • Executed preauthorize_dev_permissions.zsh across all 6 machines.
   • Enabled DevToolsSecurity.
   • Granted AuthorizationDB rights: system.privilege.taskport, system.privilege.taskport.debug, system.privilege.taskport.safe, and system.device.developer.allow.
   • Verified developer user group memberships (_developer for richh and joey).
   • Allow-listed dev tooling with macOS Application Firewall (socketfilterfw).
3. Apple Remote Desktop (ARD) & Screen Sharing Configuration:
   • Executed ARD kickstart on all 6 hosts: sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -users richh -access -on -privs -all -restart -agent -console -menu
   • Configured full remote management, screen control, and console privileges for richh.
4. TCC Permission Matrix Audit:
   • Audited kTCCServiceScreenCapture, kTCCServiceAccessibility, kTCCServiceSystemPolicyAllFiles, and kTCCServiceDeveloperTool across all hosts for Terminal, Ghostty, Warp, Antigravity, Claude, and Codex.

Verification Evidence

• All 6 hosts returned exit code 0 on preauthorize_dev_permissions.zsh.
• All 6 hosts returned Set user remote control privileges and Set user remote access on ARD kickstart.
• TCC audit confirmed Terminal.app has Full Disk Access fleet-wide and Screen Capture / Accessibility enabled on rdmsm4x, rdmbair13m5, rdmbair15m5, and jdmbair13m5.