RTTy App Store — app-group question resolved; blocker moved to the installer key's ACL prompt

rdmsm4x, 2026-09-10 15:46–15:55 EDT. claude@rdmsm4x, App Store channel. Merged as richhdoty/RTTy PR #48, merge commit b25f316. Follow-on to PR #47 (484dc2e).

One line: the Mac Installer Distribution certificate now exists and resolves, but its private key has no codesign ACL entry, so the first signature blocks on an unanswered SecurityAgent prompt; separately, the app-group format question is answered from Apple's docs and needs no code change.

Changed

Docs only — docs/app-store/UPLOAD_PREREQS_20260910.md §5 (new) and ISSUES.md. No code, no entitlement, no trust-chain member touched.

Measured

• security find-identity -v ~/Library/Keychains/login.keychain-db → 4 identities, row 4 3rd Party Mac Developer Installer: east coast science, llc (ZU2882L4HT), SHA-1 955A0A048637CD7AE6D5F46939CAAA000153ADF5.
• Probe: pkgbuild a one-byte payload (rc=0), then productsign --sign "<that identity>" --keychain ~/Library/Keychains/login.keychain-db → blocked 7 m 50 s, no output. sample frame: SecKeyCreateSignature → SecKeyRunAlgorithmAndCopyResult → SecCDSAKeyCopyOperationResult → CSSM_SignData → mach_msg → mach_msg2_trap — a synchronous wait on securityd for a key-access decision. SecurityAgent pid 2644 resident since ~15:41, the first attempt.
• The signed-export branch of script/archive_standard.sh is therefore still unexecuted.

Owner action (either one)

1. Click Always Allow on the SecurityAgent dialog; or
2. security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k <keychain password> \ ~/Library/Keychains/login.keychain-db — needs the keychain password and rewrites the partition list for every key in the login keychain, so not an agent's to run.

The probe process (pid 15461) was left running on purpose as the canary: when the prompt is answered it completes on its own and its exit code proves the ACL is granted. Killing it would dismiss the dialog that needs clicking.

App groups — resolved, no change needed

Apple documents both group.<name> and <TeamID>.<name> as valid on macOS; the prefixed form merely skips Developer-website registration. RTTy's group is registered — both Mac App Store profiles grant group.com.eastcoastscience.rtty. The macOS 15 SIP rule on ~/Library/Group Containers lists alternatives, and a Store build satisfies two of them. Recorded for RTTyNetworkFilter.appex because an extension failing all three is denied silently, and carried to the Direct channel to confirm rather than assume. Sources and the three things Apple does not document: docs/app-store/UPLOAD_PREREQS_20260910.md §5.

Undo

git revert -m 1 b25f316. Nothing was installed; no keychain modified — security list-keychains still reads login, fleet-signing, System, in that order.