rdmsm4x-changelog-20260828-1847-tyrell-developer-authorization-preflight

Tyrell developer authorization preflight committed in an isolated worktree

Scope: rdmsm4x source-only Tyrell branch; no configuration, authorization, Keychain, signing, deployment, remote-host, canary, or fleet state changed.

Changelog

Created isolated worktree /Users/richh/dev/_worktrees/tyrell-developer-auth-reconciler-20260828 from exact base 42e9287a7d79548b7b41f61f3f9c3ce1099c731b on branch codex/tyrell-developer-auth-reconciler-20260828.
Committed 5cfa9002f6f30a0c9620f5851d2a28b1e5ec6e1e with the local-only scripts/tyrell_developer_authorization_preflight.sh, its focused contract test, operator documentation, and source report.
The script audits DevToolsSecurity, _developer, exact signed Xcode tools and firewall entries, Aqua/Background, login/signing Keychain capability, physical iOS visibility/pairing/unlock state, Tyrell signing identity, and the intentional TCC manual boundary. It reports typed JSON and a blocking rollout gate; --reconcile is narrow and requires local non-interactive sudo.
Commands run: bash -n, zsh focused contract test, ASCII scan, git diff --check, and an audit-only bounded --check --timeout 3 run. The audit JSON parsed successfully and correctly returned a blocked gate from this Background harness; no reconciliation was attempted.

Verification

Focused contract: PASS.
Script syntax and ASCII scan: PASS.
Whitespace validation: PASS.
Runtime JSON: valid; 33 checks; rollout gate blocked truthfully in Background.

Rollback

The source-only change is isolated at the commit above. Do not deploy it.
To abandon the candidate, remove only this linked worktree and branch after owner acceptance/rejection; canonical main was not modified.

Outstanding owner actions

Review and integrate the candidate only through the Tyrell owner workflow.
Run any reconciliation only from an authorized local Aqua session and only after MDM/TCC/signing policy review. Apple Notes publication is pending because this agent ran in Background, where Notes AppleEvents are intentionally not available.