Prepare HRA v0.1.15 forward recovery

[0thernet]

Summary

• prepare the self-managed HRA v0.1.15 macOS release candidate and deterministic release contract
• add bounded B14 to B15 installation forward recovery with exact custody continuity and rollback evidence
• replace ambient signing identity discovery with one isolated, nonextractable Keychain signer and strict package verification
• harden native renderer, gateway, Keychain, resident-custody, and installation-handoff boundaries
• select the exact two-argument macOS 13–15 or three-argument macOS 26 remote-signing callback ABI, while failing closed on macOS 27 pending review
• pin the release signer helper to SHA-256 and 16 KiB code pages across macOS 15 and macOS 26

Verification

• exact clean one-commit candidate with sole parent Q14
• local macOS 26 structural package, including remote CMS signing and post-sign reconstruction
• signing-preflight regression: 15 passing tests
• desktop typecheck and lint
• repository policy suite
• release-source proof
• credential-free remote release-history and collision proof
• predecessor v9 Required run passed the complete source suite, 3,296 tests, native macOS tests, and macOS 26 normalization before exposing the macOS 15 callback ABI mismatch at the first structural signature

The candidate is one commit and one parent after Q14 (ceb647f7a4a68546fc68ce5e70e770b73c8863eb). Its tree contains the reviewed v9 candidate plus only the evidence-backed callback compatibility fix. The remote has no v0.1.15 tag or release collision.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hra-v0	Ready	Preview	Aug 24, 2026 3:41am

[0thernet]

Superseded by #51, which preserves the exact release-candidate tree and adds only the bounded outer timeout for the capacity property test.