Regression-test permissions, daemon, and TCC behavior on macOS 27 betas

[malpern]

Post-1.0 tracking, but should happen during the macOS 27 beta cycle (public release expected September 2026). From the WWDC 2026 review — see docs/wwdc-2026-macos-27-opportunities.md (PR #911), §10.

Why

Nothing announced at WWDC26 changes SMAppService, XPC, or the TCC/Input Monitoring surface on paper — but TCC behavior shifts are historically where macOS major releases bite this app (PermissionOracle exists for exactly this reason).

Checklist (on each significant beta seed)

• PermissionOracle snapshots: IOHIDCheckAccess vs TCC DB precedence still correct (ADR-001, ADR-006)
• Accessibility + Input Monitoring grant/revoke flows and the installer wizard
• SMAppService daemon registration/approval flow (KanataDaemonService), including the Login Items UI changes in the new System Settings
• XPC helper code-signature validation still passes under the new SDK
• Sparkle update + notarization/Gatekeeper assessment on macOS 27 (Scripts/verify-installed-app.sh)
• Kanata daemon keyboard capture end-to-end (the macOS 27 design refresh touches system chrome; verify overlay windows render correctly)

https://claude.ai/code/session_01Nsiqm39oCwHkbrHytefnGM