rdmsm4x - code - rdtcc v2 fleet TCC evidence run and four scan fixes on branch - claude-mhtcc926 - FEAT-20260926-12 - RDmacTCCfix - 20260926-2235
rdmsm4x - code - rdtcc v2 fleet TCC evidence run and four scan fixes on branch - claude-mhtcc926 - FEAT-20260926-12 - RDmacTCCfix - 20260926-2235
Summary: I finished the evidence for
rdtcc, the read-only fleet TCC check tool. The final scan
reached 6/6 hosts with every host at 5/5 sources. Four defects found
during the live runs are fixed. The watch LaunchAgent is live on
rdmsm4x.
- When: 2026-09-26 21:27:37 → 22:35:24 EDT (resumed after the ~21:24 reboot; the build began 17:11)
- Host: rdmsm4x (runs); read-only ssh to all six fleet Macs
- Agent: claude@rdmsm4x/mhtcc926 (builder). Coordinator: rdmactccfix@rdmsm4x
- Worktree / branch:
~/dev/_worktrees/machealth-tcc-20260926,machealth/tcc-v2-20260926, HEADfc81847(not pushed) - Proof:
~/dev/_handoff/machealth-tcc-20260926/EVIDENCE.md,RESULT.md,evidence/
Local state changed
~/Library/LaunchAgents/com.eastcoastscience.rdtcc.watch.plist: installed 21:36, reinstalled 22:21. Every 30 min it runs~/Library/Application Support/RDmacTCCfix/bin/rdtcc watch --run-once.~/Library/Application Support/RDmacTCCfix/: installed binary,heartbeat.json,watch-state.json,last-scan.json,watch.log.- The bus got 6
tcc-driftmessages to rdmactccfix@rdmsm4x, plus 1tcc-builder-donereport. - rdmbair15m5:
/tmp/rdtcc-evidence/rdtcc(a temp copy, used only for the A7 no-flag run). - System Settings was opened once on the rdmsm4x console, at the Full
Disk Access pane, as
openevidence. - Nothing written to any TCC store or clients.plist.
No
tccutil reset, and no legacy--repair.
Commits (explicit paths)
b2c749f:openusessudo -n launchctl asuser … sudo -u(plain asuser fails from ssh)ccc96c0: preflight kept its bare@P endsentinel (every host had read as "did not finish")2bfb0ad: the watch message names incomplete-coverage hosts1f311cd: the collector keeps the newest AUTHREQ lines (the old cap kept the oldest, so watch diffs flapped); addssources_read.tccd_log_truncated(schema + INTERFACES, additive); ssh budget 180 → 600 s for Intel codesign checks9435f38,fc81847: docs
Verification (counts, not "green")
- Tests: 27 executed, 1 skipped, 0 failed. Universal2 lipo ok on rdtcc, rdtcc-mcp and RDTCCCanary.
- Final scan at 22:28: 6/6 hosts, 5/5 sources each, exit 1, schema-valid. Preflight: 6/6, exit 0.
- A7 no-flag run on rdmsm4x and rdmbair15m5: clients.plist sha256 and TCC.db mtime+sha256 identical before and after.
- Positive control: found on both canary hosts; an absent control
gives exit 2
scan_broken.
Undo
- Watch job:
~/Library/Application\ Support/RDmacTCCfix/bin/rdtcc watch --uninstall(moves the plist aside). - Code: the branch is unmerged; drop it or revert the commits listed above.
Outstanding (owners)
reset --apply: waits for claude@rdmsm4x's ruling on criterion 2 vs FLEET.md §7 (bus topicsigning-tcc-home).- The rdmsm4x canary was switched ON at the console at 21:28:36 (ISS-RDTCC-005). Restore it after the ruling.
- ISS-RDTCC-010: a live
"changed": falseheartbeat is still pending, because the fleet kept changing. - Apple Notes copy: pending. This session is headless
(
launchctl managername= Background), andnotes_changelog.zshrefuses to run from one.