rdmsm4x-changelog-20260923-0058-developer-id-p12-exported

Exported the Developer ID Application identity to the one file every spoke imports on its next dev_update run.

• Window: 2026-09-23 00:47–00:58 EDT, rdmsm4x (Aqua session; Rich approved the keychain dialog)
• Cause of "no password prompt": replicate_developer_id.zsh only imports/copies an existing p12; it never exports.
• ~/.secrets/signing/developer_id_application.key.pem does NOT match the live cert (public-key hash mismatch) — not usable.
• Created ~/.secrets/signing/developer_id_application.p12 (600), leaf SHA-1 1C07FCD80C36EAD5D9E3B73F7ACCCA5368DC73FB, legacy PKCS#12 wrapped with FLEET_SIGNING_P12_PASSWORD (name only).
• Verified: decrypts; real security import into a throwaway keychain shows 1 valid identity; wrong passphrase rc=1.
• All 5 spokes: identity currently absent (0), passphrase key present, basis file readable over ssh → rmfix_signing_identity (dev_update 2.09) imports on next run.
• Plaintext intermediates shredded from session scratchpad.
• Do NOT run replicate_developer_id.zsh: swallows import errors (prints PASS on failure), omits jdmbair13m5, and would re-create the fleet-signing keychain shadow on rdmsm4x.
• Undo: mv the p12 into ~/.secrets/signing/archive/.

Close-out 2026-09-23 14:26–14:31 EDT

• All 5 spokes imported it on their own dev_update runs. Verified by a real codesign on each (rc 0, Developer ID authority) 5/5; login keychain first on 5/5.
• replicate_developer_id.zsh retired: early exit 3 with the reasons in its header. Snapshot: ~/.agent-coordination/snapshots/rdmsm4x/fleet/20260923-142659.
• fleet/signing-finish-20260905/STATUS.md §7 appended (key.pem is an orphan from an unused CSR; kept).
• Ticket TASK-20260923-01 opened and resolved with evidence.
• fleet-update ISSUES.md correction relayed via ~/dev/todo/items/20260923-fleet-update-devid-exported.md.
• Note: signing-finish-20260905/ is untracked in the fleet repo (it was before this session). Not committed here; left to the kit's owner.