rdmbair15m5-changelog-20260920-2140-rtty-app-store-standard-hardening-and-universal-packaging

Hardened RTTy macOS Standard App Store channel under strict App Sandbox, implemented automated Universal2 fat Mach-O packaging and validation, aligned compiler graph projections for Path MTU assessment, and validated UI performance and memory leak gates (<0.5% idle CPU, <60MB RSS).

Scope

• Hosts: rdmbair15m5 (execution & validation), rdmsm4x (canonical git hub & ticket store).
• Repositories: apps/RTTy on git.ecs0.net:git/apps/RTTy.git, synced to canonical working tree on rdmsm4x:~/dev/apps/RTTy.
• Tickets: EPIC-20260911-01 (RTTy Production Release), TASK-20260916-03 (Standard Channel Hardening & Universal2 Packaging), ISSUE-20260911-17 / ISSUE-20260915-10 (UI Memory Leak & Dynamic Cadence Audit).

Exact Files Touched

• Apps/RTTyStandard/RTTyStandard.xcodeproj/project.pbxproj: Registered PathMTUFragmentationAssessment.swift in PBX sources build phase.
• Apps/RTTyStandard/project.yml: Added PathMTUFragmentationAssessment.swift to LatencyCore sources for deterministic xcodegen generation.
• Apps/RTTyTV/App/Info.plist: Unified ITSAppUsesNonExemptEncryption = false across all platform bundle manifests.
• Sources/RTTy/Services/ContinuousPingProbeService.swift: Added deinit process termination to prevent orphan process leaks during live continuous probes.
• Sources/RTTy/Views/DashboardView.swift: Hardened WindowVisibilityGate to render Color.clear when window is occluded or miniaturized, halting @Observable body recomputations and subscriptions.
• Tests/RTTyTests/ApplicationGraphProjectionTests.swift: Isolated synthetic process testing PIDs (99998/99999) from host OS proc_pidpath collisions.
• Tests/RTTyTests/DashboardEvidenceSnapshotTests.swift: Added testDashboardBodyBuildsZeroEvidenceSnapshotsWhenWindowIsNotVisible.
• Tests/RTTyTests/MenuBarLabelRenderingTests.swift: Added testPopoverNotificationHandlersToggleMonitoringCadence.
• Tests/RTTyTests/Milestone1StandardSandboxAdversarialTests.swift: Unit test suite asserting sandbox compliance and rejection of unsandboxed process spawns.
• Tests/RTTyTests/Milestone3PerformanceAndMemoryGateTests.swift: UI performance, cadence relaxation (5.0s idle vs 1.0s active), and 5-minute sampling memory gate suite.
• Tests/RTTyTests/StandardCapabilityMatrixTests.swift: Added testStandardPathMTUReturnsGracefullyUnsupportedWithoutProcessOrSocket.
• Tests/RTTyTests/WindowVisibilityGateTests.swift: Added testDashboardWatchedSurfaceMatrix covering scene phases and visibility states.
• Tests/ScriptTests/standard_candidate_closure_test.py: Reconciled compiler fixture counts from 136 to 137 (71 direct + 57 LatencyCore + 1 network filter + 8 schema).
• Tests/ScriptTests/standard_entitlements_contract_test.sh: Automated entitlement verifier ensuring zero unauthorized capabilities and exact App Sandbox policy.
• Tests/ScriptTests/standard_source_policy_adversarial_test.py: Adversarial scanner verifying fail-closed rejection of 67 unauthorized process spawning calls.
• Tests/ScriptTests/standard_ui_performance_and_leak_contract_test.sh: Automated UI performance, cadence relaxation, and occlusion gate contract tests.
• Tests/ScriptTests/standard_universal_package_contract_test.sh: Universal2 fat Mach-O verification and AppleDouble (._*) / .DS_Store payload cleanliness verifier.
• build.sh: Integrated script/package_distribution_pkg.sh into release build workflow.
• script/package_distribution_pkg.sh: Automated distribution packaging engine producing clean dist/RTTy.pkg.
• script/qa_release.sh: Integrated Milestone 1-3 contract test scripts into release gate verification.
• script/standard_archive_validator.py: Updated EXPECTED_COMPILER_INPUT_COUNT (137) and EXPECTED_BUILD_INPUT_COUNT (168).
• script/standard_project_graph.py: Updated EXPECTED_COMPILER_INPUT_COUNT (137) and EXPECTED_BUILD_INPUT_COUNT (168).
• .gitignore: Added __pycache__/ and *.pyc to maintain clean working trees.

Commands Run

1. Entitlements Contract: bash Tests/ScriptTests/standard_entitlements_contract_test.sh (PASS, 7/7 checks)
2. Source Policy Adversarial: python3 Tests/ScriptTests/standard_source_policy_adversarial_test.py (PASS, 67 caught / 9 verified)
3. Universal Package Contract: bash Tests/ScriptTests/standard_universal_package_contract_test.sh (PASS, 5/5 phases)
4. UI Performance & Leak Contract: bash Tests/ScriptTests/standard_ui_performance_and_leak_contract_test.sh (PASS, 4/4 assertions)
5. PBX Compiler Projection: python3 -I -B Tests/ScriptTests/standard_pbx_source_closure_test.py (PASS)
6. Candidate Closure Test: python3 -I -B Tests/ScriptTests/standard_candidate_closure_test.py (PASS, all 137 inputs closed)
7. Standard Project Test: bash Tests/ScriptTests/standard_project_test.sh (PASS)
8. Full Test Suite: CLANG_MODULE_CACHE_PATH=/private/tmp/rtty-test-cache/clang SWIFTPM_MODULECACHE_OVERRIDE=/private/tmp/rtty-test-cache/swiftpm swift test (PASS, 1,438 tests across LatencyCoreTests, RTTySyncSchemaTests, RTTyTests with 0 failures)
9. Commit & Push: git commit -m "feat(release): ..." -> commit 9c71621 pushed to git.ecs0.net:git/apps/RTTy.git
10. Canonical Sync: ssh [email protected] "cd ~/dev/apps/RTTy && git pull --ff-only fleet main" (Fast-forwarded to 9c71621)
11. GitHub Mirroring: ssh [email protected] "cd ~/dev/apps/RTTy && git push origin main && git push backup main"

Verification Evidence

• dist/RTTy.app/Contents/MacOS/RTTy: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64]
• dist/RTTyPrivilegedHelper: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64]
• dist/RTTy.pkg: Size 14,323,123 bytes, 0 AppleDouble (._*) files, 0 .DS_Store files.
• TASK-20260916-03: Resolved in canonical issue store on rdmsm4x, validated by claude@rdmsm4x.
• Full SwiftPM test run: 1,438 tests executed, 8 skipped, 0 failures (rc=0).

Backup Locations & How to Undo

• Git commit: 9c71621 on main. To undo, revert commit 9c71621 via git revert 9c71621 and push to git.ecs0.net.
• Rollback archive of staged binaries preserved under dist/ and build intermediates under .build/.

Outstanding Owner Actions

• None. All tasks completed autonomously with 100% verified test passes and canonical parity.