From 1eefd44b6d354d85e69d79ec7d55bd1c13b9a63a Mon Sep 17 00:00:00 2001
From: Anthony Ronning <101225832+AnthonyRonning@users.noreply.github.com>
Date: Thu, 29 Oct 2026 02:38:20 +0000
Subject: [PATCH 1/6] ci: accept suffixed Xcode installs with the pinned build

GitHub's Xcode 27 image keeps 27.1 (27A9275) as
Xcode_27.1_Release_Candidate.app, and its default is still 27.0.
Consider Xcode_<version>_*.app installs too; selection still requires
the exact pinned build and still skips betas.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 scripts/ci/select-xcode.py      |  5 ++++-
 scripts/ci/test_select_xcode.py | 13 +++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/scripts/ci/select-xcode.py b/scripts/ci/select-xcode.py
index 2e29aadb5..8a85f59cb 100644
--- a/scripts/ci/select-xcode.py
+++ b/scripts/ci/select-xcode.py
@@ -29,7 +29,10 @@ def load_pin(path=PIN):
 
 def select_xcode(pin, applications=Path("/Applications")):
     version = pin["version"]
-    for name in (f"Xcode_{version}.app", f"Xcode_{version}.0.app", "Xcode.app"):
+    # Hosted images may keep a release under a suffixed name (for example
+    # Xcode_27.1_Release_Candidate.app); the exact build check below decides.
+    suffixed = sorted(path.name for path in applications.glob(f"Xcode_{version}_*.app"))
+    for name in (f"Xcode_{version}.app", f"Xcode_{version}.0.app", *suffixed, "Xcode.app"):
         developer = applications / name / "Contents/Developer"
         if not (developer / "usr/bin/xcodebuild").is_file():
             continue
diff --git a/scripts/ci/test_select_xcode.py b/scripts/ci/test_select_xcode.py
index e2115b194..2785cc128 100644
--- a/scripts/ci/test_select_xcode.py
+++ b/scripts/ci/test_select_xcode.py
@@ -97,6 +97,19 @@ def test_beta_install_and_disguised_beta_symlink_are_never_probed(self):
                 selector.select_xcode(self.pin, self.directory)
             run.assert_not_called()
 
+    def test_suffixed_release_install_is_selected_by_exact_build(self):
+        self.install("Xcode_26.5_beta_2.app")
+        developer = self.install("Xcode_26.5_Release_Candidate.app")
+        with patch.object(selector.subprocess, "run", return_value=self.result()) as run:
+            self.assertEqual(selector.select_xcode(self.pin, self.directory), developer)
+        self.assertEqual(run.call_count, 1)
+
+    def test_suffixed_install_with_another_build_is_rejected(self):
+        self.install("Xcode_26.5_Release_Candidate.app")
+        with patch.object(selector.subprocess, "run", return_value=self.result(build="17F40")):
+            with self.assertRaisesRegex(selector.ToolchainError, "26.5 build 17F42"):
+                selector.select_xcode(self.pin, self.directory)
+
     def test_rolling_default_is_skipped_when_pinned_release_is_available(self):
         self.install("Xcode_26.5.app")
         developer = self.install("Xcode_26.5.0.app")

From 70a0547308ba1bc80a8f2a47d1cc247f6eb8b091 Mon Sep 17 00:00:00 2001
From: Anthony Ronning <101225832+AnthonyRonning@users.noreply.github.com>
Date: Thu, 29 Oct 2026 02:38:58 +0000
Subject: [PATCH 2/6] ci: make Agent and Research builds work with the macOS 27
 SDK

These are no-ops on Xcode 26.5 and needed before the Xcode 27.1 pin.

- Agent shell: link Rust with Xcode's clang as well. nixpkgs' ld64
  cannot read the macOS 27 SDK's .tbd stubs (they list arm64e.x1), so
  build scripts failed to link (_strerror_r undefined).
- Research and Agent: stop stripping build scripts and proc-macros in
  release builds. rustc strips Apple outputs with rust-objcopy, which
  doesn't pad __LINKEDIT entries, so chained-fixup images (deployment
  target 12+) can end up with a 4-byte-aligned string table. macOS 27's
  dyld refuses such dylibs once they're linked against the macOS 27 SDK,
  so rustc could not load zerofrom-derive ("can't find crate").
  Executables aren't checked, so shipped binaries keep their strip
  settings. Upstream fix: llvm/llvm-project#203680.
- test-canonical-macho: Xcode 27's ld sorts local absolute symbols, so
  both fixtures came out in the same order. Swap the entries to recreate
  the input-order variant older linkers emitted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/maple-agent/Cargo.toml                   |  8 +++++
 apps/maple-agent/flake.nix                    |  5 +++
 .../frontend/src-tauri/Cargo.toml             |  8 +++++
 scripts/ci/test-canonical-macho.py            | 33 +++++++++++++++++++
 4 files changed, 54 insertions(+)

diff --git a/apps/maple-agent/Cargo.toml b/apps/maple-agent/Cargo.toml
index 6da94889d..a5660ddaa 100644
--- a/apps/maple-agent/Cargo.toml
+++ b/apps/maple-agent/Cargo.toml
@@ -35,6 +35,14 @@ lto = "fat"
 codegen-units = 1
 strip = true
 
+# rustc strips with rust-objcopy, which can leave a dylib's LINKEDIT string table
+# 4-byte aligned. macOS 27 refuses to load such dylibs when they are linked against
+# its SDK, and the build loads its proc-macros as dylibs. Build scripts and
+# proc-macros never ship, so leave them unstripped. Remove once the pinned Rust's
+# rust-objcopy includes llvm/llvm-project#203680.
+[profile.release.build-override]
+strip = false
+
 # The embedded proxy requires `maple-sdk` from the registry; resolve it to the same
 # in-tree source as the workspace dependency above (docs/sdk-publishing.md).
 [patch.crates-io]
diff --git a/apps/maple-agent/flake.nix b/apps/maple-agent/flake.nix
index ac7a6df80..e0ac4c226 100644
--- a/apps/maple-agent/flake.nix
+++ b/apps/maple-agent/flake.nix
@@ -310,6 +310,11 @@
               # nixpkgs' generic clang wrapper cannot infer that SDK boundary.
               export CC="$(/usr/bin/xcrun --find clang)"
               export CXX="$(/usr/bin/xcrun --find clang++)"
+              # Rust links through `cc`, which is nixpkgs' clang wrapper and its
+              # older ld64. That ld64 cannot read the macOS 27 SDK's .tbd stubs
+              # (they list the arm64e.x1 architecture), so link with Xcode too.
+              export CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER="$CC"
+              export CARGO_TARGET_X86_64_APPLE_DARWIN_LINKER="$CC"
               export PATH="${xcrun}/bin:$PATH"
 
               unset maple_nix_developer_dir maple_nix_selected_developer_dir
diff --git a/apps/maple-research/frontend/src-tauri/Cargo.toml b/apps/maple-research/frontend/src-tauri/Cargo.toml
index 4770e167c..be10e613b 100644
--- a/apps/maple-research/frontend/src-tauri/Cargo.toml
+++ b/apps/maple-research/frontend/src-tauri/Cargo.toml
@@ -118,3 +118,11 @@ tao = { path = "patches/tao-0.37.1" }
 # to link (Tauri 2.12.3 made its own public: tauri-apps/tauri#16130); the
 # vendored copy only adds that keyword. Remove once upstream publishes the fix.
 tauri-plugin-sign-in-with-apple = { path = "patches/tauri-plugin-sign-in-with-apple-1.0.2" }
+
+# Release builds strip with rustc's rust-objcopy, which can leave a dylib's LINKEDIT
+# string table 4-byte aligned. macOS 27 refuses to load such dylibs when they are
+# linked against its SDK, and the build loads its proc-macros as dylibs. Build
+# scripts and proc-macros never ship, so leave them unstripped. Remove once the
+# pinned Rust's rust-objcopy includes llvm/llvm-project#203680.
+[profile.release.build-override]
+strip = false
diff --git a/scripts/ci/test-canonical-macho.py b/scripts/ci/test-canonical-macho.py
index 99e344fe0..94790a3af 100644
--- a/scripts/ci/test-canonical-macho.py
+++ b/scripts/ci/test-canonical-macho.py
@@ -71,6 +71,35 @@ def local_absolute_symbols(path):
     return symbols
 
 
+def swap_local_absolute_symbols(path):
+    """Swap the first two local absolute nlist entries in place."""
+    data = bytearray(Path(path).read_bytes())
+    _, _, _, _, ncmds, _, _, _ = struct.unpack_from("<IiiIIIII", data)
+    command_offset = 32
+    for _ in range(ncmds):
+        command, command_size = struct.unpack_from("<II", data, command_offset)
+        if command == LC_SYMTAB:
+            symbol_offset, symbol_count, _, _ = struct.unpack_from(
+                "<IIII", data, command_offset + 8
+            )
+            break
+        command_offset += command_size
+    else:
+        raise AssertionError(f"Mach-O has no symbol table: {path}")
+    entries = []
+    for index in range(symbol_count):
+        entry_offset = symbol_offset + index * 16
+        symbol_type = data[entry_offset + 4]
+        if not symbol_type & N_STAB and (symbol_type & N_TYPE) == N_ABS and not symbol_type & N_EXT:
+            entries.append(entry_offset)
+    first, second = entries[:2]
+    data[first:first + 16], data[second:second + 16] = (
+        data[second:second + 16],
+        data[first:first + 16],
+    )
+    Path(path).write_bytes(bytes(data))
+
+
 class CanonicalMachoTests(unittest.TestCase):
     def build_executable(self, output, local_symbols, return_value, global_symbol):
         object_path = output.with_suffix(".o")
@@ -145,6 +174,10 @@ def test_local_absolute_symbol_order_is_not_runtime_content(self):
             )
 
             self.assertEqual(local_absolute_symbols(executable_ab), symbols_ab)
+            if local_absolute_symbols(executable_ba) == symbols_ab:
+                # Xcode 27's ld sorts local absolute symbols, so reproduce the
+                # input-order variant older linkers emitted by swapping the entries.
+                swap_local_absolute_symbols(executable_ba)
             self.assertEqual(local_absolute_symbols(executable_ba), symbols_ba)
 
             canonical_ab = CANONICALIZER.canonical_macho(executable_ab)

From 4ee2192e8b412ad346ac561cb8e0f17474d91b1d Mon Sep 17 00:00:00 2001
From: Anthony Ronning <101225832+AnthonyRonning@users.noreply.github.com>
Date: Thu, 29 Oct 2026 02:40:57 +0000
Subject: [PATCH 3/6] ci: pin Xcode 27.1 and move Apple jobs to the Xcode 27
 images

Xcode 27.1 (27A9275) adds the iOS 27.1 SDK and iPhone Duo support, and
App Store Connect requires the iOS 27 SDK from April 2027. The macOS 26
images have no Xcode 27, so every job that selects the pin moves:

- Blacksmith blacksmith-6vcpu-macos-26 -> blacksmith-6vcpu-macos-27:
  lanes.MACOS and ci.yml's special jobs in lockstep, plus the signed and
  release builders (agent-desktop-build, desktop-build, mobile-build,
  ios-dev-testflight, release, proxy-rust).
- GitHub macos-26 -> xcode-27: artifact verifiers, signing, TestFlight
  and the nightly provider suite.
- actionlint knows neither label yet.
- iOS ONNX Runtime builds for iOS 16.0 (the app's minimum) instead of
  13.0, because Xcode 27 only targets iOS 15.0-27.1. The hash pins move
  to 27A9275, from a local Xcode 27.1 build that reproduces them.
- Docs, the outage advice and the StoreKit harness name the new
  versions; the stale project.pbxproj.backup goes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../change-maple-ci/references/debugging.md   |   2 +-
 .github/actionlint.yaml                       |   4 +-
 .github/workflows/agent-desktop-build.yml     |   6 +-
 .github/workflows/ci.yml                      |   8 +-
 .github/workflows/desktop-build.yml           |   4 +-
 .github/workflows/ios-dev-testflight.yml      |   4 +-
 .github/workflows/mobile-build.yml            |   6 +-
 .github/workflows/nightly.yml                 |   2 +-
 .github/workflows/proxy-rust.yml              |   2 +-
 .github/workflows/release.yml                 |  10 +-
 .../maple.xcodeproj/project.pbxproj.backup    | 626 ------------------
 .../scripts/build-ios-onnxruntime-all.sh      |   2 +-
 .../scripts/build-ios-onnxruntime.sh          |   2 +-
 .../src-tauri/scripts/onnxruntime-pins.sh     |  18 +-
 .../src-tauri/tests/storekit/README.md        |  23 +-
 docs/ci.md                                    |   2 +-
 docs/repository-workflows.md                  |   4 +-
 scripts/ci/_common.sh                         |   2 +-
 scripts/ci/apple-toolchain.json               |   4 +-
 scripts/ci/lanes.py                           |   2 +-
 scripts/testing/storekit/run.sh               |   7 +-
 21 files changed, 55 insertions(+), 685 deletions(-)
 delete mode 100644 apps/maple-research/frontend/src-tauri/gen/apple/maple.xcodeproj/project.pbxproj.backup

diff --git a/.agents/skills/change-maple-ci/references/debugging.md b/.agents/skills/change-maple-ci/references/debugging.md
index 915e46d47..19ee47d4b 100644
--- a/.agents/skills/change-maple-ci/references/debugging.md
+++ b/.agents/skills/change-maple-ci/references/debugging.md
@@ -70,7 +70,7 @@ the cancellation to finish, so rapid re-pushes each add some delay.
   variable `CI_LINUX_HEAVY_RUNNER=blacksmith-16vcpu-ubuntu-2404` (same
   vendor, so caches still work) and unset it afterwards. For the 8-vCPU
   lanes, `CI_LINUX_RUNNER=blacksmith-16vcpu-ubuntu-2404` keeps Blacksmith's
-  store. In a Blacksmith-wide outage use `ubuntu-latest` (or `macos-26`,
+  store. In a Blacksmith-wide outage use `ubuntu-latest` (or `xcode-27`,
   `windows-2025`): cold, saves nothing, slower.
   - Matrix lanes take their runner from `plan`, so re-plan: cancel a PR run,
     then **Re-run all jobs**. Never cancel a master run; the variable applies
diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index 571459b27..8b5c0d6e8 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -3,8 +3,10 @@ self-hosted-runner:
   labels:
     - blacksmith-16vcpu-ubuntu-2404-arm
     - blacksmith-8vcpu-windows-2025
-    - blacksmith-6vcpu-macos-26
+    - blacksmith-6vcpu-macos-27
     - blacksmith-8vcpu-ubuntu-2404
     - blacksmith-32vcpu-ubuntu-2404
     # GitHub-hosted larger runner (org runner group "Maple"); actionlint only knows standard labels.
     - maple-windows-2025-16core
+    # GitHub-hosted Xcode 27 image; newer than the pinned actionlint label list.
+    - xcode-27
diff --git a/.github/workflows/agent-desktop-build.yml b/.github/workflows/agent-desktop-build.yml
index c0c529a58..266dd2440 100644
--- a/.github/workflows/agent-desktop-build.yml
+++ b/.github/workflows/agent-desktop-build.yml
@@ -55,7 +55,7 @@ jobs:
     name: Build macOS binary (${{ matrix.variant }})
     needs: changes
     if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.agent != 'false') && github.repository == 'MaplePrivacyLabs/Maple' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule') }}
-    runs-on: blacksmith-6vcpu-macos-26
+    runs-on: blacksmith-6vcpu-macos-27
     permissions:
       contents: read
     timeout-minutes: 120
@@ -138,7 +138,7 @@ jobs:
       contents: read
       id-token: write
       attestations: write
-    runs-on: macos-26
+    runs-on: xcode-27
     timeout-minutes: 120
     strategy:
       fail-fast: false
@@ -513,7 +513,7 @@ jobs:
     permissions:
       contents: read
       attestations: read
-    runs-on: macos-26
+    runs-on: xcode-27
     timeout-minutes: 30
     strategy:
       fail-fast: false
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 271f33873..1766b3420 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -233,7 +233,7 @@ jobs:
     name: agent-package-macos
     needs: plan
     if: fromJSON(needs.plan.outputs.lanes)['agent-package-macos']
-    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-26' }}
+    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-27' }}
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -355,7 +355,7 @@ jobs:
     name: research-ios
     needs: plan
     if: fromJSON(needs.plan.outputs.lanes)['research-ios']
-    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-26' }}
+    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-27' }}
     timeout-minutes: 120 # a missed ONNX Runtime cache builds it from source
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -388,7 +388,7 @@ jobs:
     name: research-desktop-macos
     needs: plan
     if: fromJSON(needs.plan.outputs.lanes)['research-desktop-macos']
-    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-26' }}
+    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-27' }}
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -498,7 +498,7 @@ jobs:
     name: research-dev-macos
     needs: plan
     if: fromJSON(needs.plan.outputs.lanes)['research-dev-macos']
-    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-26' }}
+    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-27' }}
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index bfff307bb..7891bd453 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -15,7 +15,7 @@ jobs:
     environment: desktop-signing
     needs: changes
     if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.macos != 'false') }}
-    runs-on: blacksmith-6vcpu-macos-26
+    runs-on: blacksmith-6vcpu-macos-27
     timeout-minutes: 120
     permissions:
       contents: read
@@ -214,7 +214,7 @@ jobs:
   verify-macos-desktop-artifacts:
     needs:
       - build-macos
-    runs-on: macos-26
+    runs-on: xcode-27
     timeout-minutes: 30
     permissions:
       contents: read
diff --git a/.github/workflows/ios-dev-testflight.yml b/.github/workflows/ios-dev-testflight.yml
index 5b7cf75e4..dc511336a 100644
--- a/.github/workflows/ios-dev-testflight.yml
+++ b/.github/workflows/ios-dev-testflight.yml
@@ -36,7 +36,7 @@ jobs:
       (github.event_name == 'workflow_dispatch' || (github.event_name == 'push' &&
         (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.ios != 'false')))
     environment: apple-signing
-    runs-on: blacksmith-6vcpu-macos-26
+    runs-on: blacksmith-6vcpu-macos-27
     timeout-minutes: 240
     permissions:
       contents: read
@@ -144,7 +144,7 @@ jobs:
       (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     needs: build-ios-dev
     environment: apple-signing
-    runs-on: macos-26
+    runs-on: xcode-27
     timeout-minutes: 45
     permissions:
       contents: read
diff --git a/.github/workflows/mobile-build.yml b/.github/workflows/mobile-build.yml
index 4a04c6a33..5bae3046e 100644
--- a/.github/workflows/mobile-build.yml
+++ b/.github/workflows/mobile-build.yml
@@ -34,7 +34,7 @@ jobs:
       github.ref == 'refs/heads/master' &&
       (github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
       (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.ios != 'false')
-    runs-on: blacksmith-6vcpu-macos-26
+    runs-on: blacksmith-6vcpu-macos-27
     # The ONNX source build and the app build each allow 90 minutes.
     timeout-minutes: 240
     permissions:
@@ -120,7 +120,7 @@ jobs:
 
   verify-ios-artifacts:
     needs: build-ios
-    runs-on: macos-26
+    runs-on: xcode-27
     timeout-minutes: 30
     permissions:
       contents: read
@@ -156,7 +156,7 @@ jobs:
       github.ref == 'refs/heads/master' &&
       (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     needs: verify-ios-artifacts
-    runs-on: macos-26
+    runs-on: xcode-27
     timeout-minutes: 45
     permissions:
       contents: read
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index b8d603b44..c42421626 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -46,7 +46,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-26, windows-latest]
+        os: [ubuntu-latest, xcode-27, windows-latest]
     defaults:
       run:
         shell: bash
diff --git a/.github/workflows/proxy-rust.yml b/.github/workflows/proxy-rust.yml
index 32f8d38e3..8b76bf186 100644
--- a/.github/workflows/proxy-rust.yml
+++ b/.github/workflows/proxy-rust.yml
@@ -45,7 +45,7 @@ jobs:
             archive: maple-proxy-linux-x86_64.tar.gz
           - runner: ubuntu-24.04-arm
             archive: maple-proxy-linux-aarch64.tar.gz
-          - runner: blacksmith-6vcpu-macos-26
+          - runner: blacksmith-6vcpu-macos-27
             archive: maple-proxy-macos-aarch64.tar.gz
           - runner: windows-2025
             archive: maple-proxy-windows-x86_64.zip
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2e002420e..40d471ee4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -137,7 +137,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - platform: blacksmith-6vcpu-macos-26
+          - platform: blacksmith-6vcpu-macos-27
             nix_shell: ci
             artifact_prefix: macos
           - platform: blacksmith-8vcpu-ubuntu-2404
@@ -452,7 +452,7 @@ jobs:
   build-ios:
     environment: apple-signing
     needs: classify-app-release
-    runs-on: blacksmith-6vcpu-macos-26
+    runs-on: blacksmith-6vcpu-macos-27
     permissions:
       contents: write
       id-token: write
@@ -619,7 +619,7 @@ jobs:
             archive: maple-proxy-linux-x86_64.tar.gz
           - runner: ubuntu-24.04-arm
             archive: maple-proxy-linux-aarch64.tar.gz
-          - runner: blacksmith-6vcpu-macos-26
+          - runner: blacksmith-6vcpu-macos-27
             archive: maple-proxy-macos-aarch64.tar.gz
           - runner: windows-2025
             archive: maple-proxy-windows-x86_64.zip
@@ -816,7 +816,7 @@ jobs:
     needs:
       - classify-app-release
       - build-tauri
-    runs-on: macos-26
+    runs-on: xcode-27
     permissions:
       contents: read
     steps:
@@ -964,7 +964,7 @@ jobs:
       - update-latest-json
       - verify-android-release-artifacts
       - verify-proxy-release-artifacts
-    runs-on: macos-26
+    runs-on: xcode-27
     permissions:
       contents: read
     steps:
diff --git a/apps/maple-research/frontend/src-tauri/gen/apple/maple.xcodeproj/project.pbxproj.backup b/apps/maple-research/frontend/src-tauri/gen/apple/maple.xcodeproj/project.pbxproj.backup
deleted file mode 100644
index 41a99a896..000000000
--- a/apps/maple-research/frontend/src-tauri/gen/apple/maple.xcodeproj/project.pbxproj.backup
+++ /dev/null
@@ -1,626 +0,0 @@
-// !$*UTF8*$!
-{
-	archiveVersion = 1;
-	classes = {
-	};
-	objectVersion = 56;
-	objects = {
-
-/* Begin PBXBuildFile section */
-		0F4AA8C5111094B8D7B033A4 /* WebKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = E996CAD20B045EF299247BEF /* WebKit.framework */; };
-		23D760C25DBAAA96DF52F98C /* MetalKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = AAFD3E024B29F57EA0D88AB5 /* MetalKit.framework */; };
-		27222ACBBD95CA356BDB87AB /* QuartzCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = BAF092EB33F2B4FDF867E2ED /* QuartzCore.framework */; };
-		46728F6CD07C626A781543FF /* Security.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 938F41BA03AF7FAB80585A60 /* Security.framework */; };
-		4E14944735CA89389849E430 /* libapp.a in Frameworks */ = {isa = PBXBuildFile; fileRef = F27A6FC4AB3E06D481B1E137 /* libapp.a */; };
-		621A96F6B965E600E714FB6C /* LaunchScreen.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = B0EAFEFF59AA7CFEF57FA63C /* LaunchScreen.storyboard */; };
-		8F9EDB5679AB5E12D6F1E071 /* UIKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = DACD0B6B9FB86AFF47366EB2 /* UIKit.framework */; };
-		90DEA2E2EC5F95784C9D8B00 /* CoreGraphics.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 898D6E7ABC92C3B9A7970DAE /* CoreGraphics.framework */; };
-		9F3ED7EA97AFC22E0B4A6EAF /* main.mm in Sources */ = {isa = PBXBuildFile; fileRef = CE20E8A9C4CF149CA9CA485A /* main.mm */; };
-		A120CF155DE2B343CEFFB77C /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 6BF4C7EB12DBD2E253B2741E /* Assets.xcassets */; };
-		B79EC8A2A1A869B9F38906ED /* assets in Resources */ = {isa = PBXBuildFile; fileRef = AF5DA3546C7B12BA141E9508 /* assets */; };
-		FB98D58EAB479A32F7CA66CA /* Metal.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = C072EB8E1CCC1094712EA7F7 /* Metal.framework */; };
-/* End PBXBuildFile section */
-
-/* Begin PBXFileReference section */
-		1094B8CB671809878F533CEC /* lib.rs */ = {isa = PBXFileReference; lastKnownFileType = text; path = lib.rs; sourceTree = "<group>"; };
-		19C98BDFCAE8C0B2FE05F13B /* maple_iOS.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = maple_iOS.entitlements; sourceTree = "<group>"; };
-		1DB07799A17353B2E32B65D3 /* Maple.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = Maple.app; sourceTree = BUILT_PRODUCTS_DIR; };
-		6BF4C7EB12DBD2E253B2741E /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
-		7BBAB8D5C4E3D05A4F48B6EA /* bindings.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = bindings.h; sourceTree = "<group>"; };
-		898D6E7ABC92C3B9A7970DAE /* CoreGraphics.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = CoreGraphics.framework; path = System/Library/Frameworks/CoreGraphics.framework; sourceTree = SDKROOT; };
-		938F41BA03AF7FAB80585A60 /* Security.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Security.framework; path = System/Library/Frameworks/Security.framework; sourceTree = SDKROOT; };
-		AAFD3E024B29F57EA0D88AB5 /* MetalKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = MetalKit.framework; path = System/Library/Frameworks/MetalKit.framework; sourceTree = SDKROOT; };
-		AF5DA3546C7B12BA141E9508 /* assets */ = {isa = PBXFileReference; lastKnownFileType = folder; path = assets; sourceTree = SOURCE_ROOT; };
-		B0EAFEFF59AA7CFEF57FA63C /* LaunchScreen.storyboard */ = {isa = PBXFileReference; lastKnownFileType = file.storyboard; path = LaunchScreen.storyboard; sourceTree = "<group>"; };
-		BAF092EB33F2B4FDF867E2ED /* QuartzCore.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = QuartzCore.framework; path = System/Library/Frameworks/QuartzCore.framework; sourceTree = SDKROOT; };
-		C072EB8E1CCC1094712EA7F7 /* Metal.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Metal.framework; path = System/Library/Frameworks/Metal.framework; sourceTree = SDKROOT; };
-		C0A332F21EB65CD4B83229DF /* main.rs */ = {isa = PBXFileReference; lastKnownFileType = text; path = main.rs; sourceTree = "<group>"; };
-		CE20E8A9C4CF149CA9CA485A /* main.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; path = main.mm; sourceTree = "<group>"; };
-		D6F6085362AF0C062EDB5810 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist; path = Info.plist; sourceTree = "<group>"; };
-		DACD0B6B9FB86AFF47366EB2 /* UIKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = UIKit.framework; path = System/Library/Frameworks/UIKit.framework; sourceTree = SDKROOT; };
-		E996CAD20B045EF299247BEF /* WebKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = WebKit.framework; path = System/Library/Frameworks/WebKit.framework; sourceTree = SDKROOT; };
-		F27A6FC4AB3E06D481B1E137 /* libapp.a */ = {isa = PBXFileReference; lastKnownFileType = archive.ar; path = libapp.a; sourceTree = "<group>"; };
-/* End PBXFileReference section */
-
-/* Begin PBXFrameworksBuildPhase section */
-		04F3BEBB04BD927FDC86B255 /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				4E14944735CA89389849E430 /* libapp.a in Frameworks */,
-				90DEA2E2EC5F95784C9D8B00 /* CoreGraphics.framework in Frameworks */,
-				FB98D58EAB479A32F7CA66CA /* Metal.framework in Frameworks */,
-				23D760C25DBAAA96DF52F98C /* MetalKit.framework in Frameworks */,
-				27222ACBBD95CA356BDB87AB /* QuartzCore.framework in Frameworks */,
-				46728F6CD07C626A781543FF /* Security.framework in Frameworks */,
-				8F9EDB5679AB5E12D6F1E071 /* UIKit.framework in Frameworks */,
-				0F4AA8C5111094B8D7B033A4 /* WebKit.framework in Frameworks */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXFrameworksBuildPhase section */
-
-/* Begin PBXGroup section */
-		31943D18956B6AFD5A82AB02 /* maple_iOS */ = {
-			isa = PBXGroup;
-			children = (
-				D6F6085362AF0C062EDB5810 /* Info.plist */,
-				19C98BDFCAE8C0B2FE05F13B /* maple_iOS.entitlements */,
-			);
-			path = maple_iOS;
-			sourceTree = "<group>";
-		};
-		6AE8986BFC081ADF4EF98889 /* Externals */ = {
-			isa = PBXGroup;
-			children = (
-			);
-			path = Externals;
-			sourceTree = "<group>";
-		};
-		A278899D6905367F60E00F01 /* Sources */ = {
-			isa = PBXGroup;
-			children = (
-				E5992A2C52DE443515252068 /* maple */,
-			);
-			path = Sources;
-			sourceTree = "<group>";
-		};
-		B58B2AB62FA5D8F41C3A031C /* Frameworks */ = {
-			isa = PBXGroup;
-			children = (
-				898D6E7ABC92C3B9A7970DAE /* CoreGraphics.framework */,
-				F27A6FC4AB3E06D481B1E137 /* libapp.a */,
-				C072EB8E1CCC1094712EA7F7 /* Metal.framework */,
-				AAFD3E024B29F57EA0D88AB5 /* MetalKit.framework */,
-				BAF092EB33F2B4FDF867E2ED /* QuartzCore.framework */,
-				938F41BA03AF7FAB80585A60 /* Security.framework */,
-				DACD0B6B9FB86AFF47366EB2 /* UIKit.framework */,
-				E996CAD20B045EF299247BEF /* WebKit.framework */,
-			);
-			name = Frameworks;
-			sourceTree = "<group>";
-		};
-		C312B5C9A1506139452E194B /* Products */ = {
-			isa = PBXGroup;
-			children = (
-				1DB07799A17353B2E32B65D3 /* Maple.app */,
-			);
-			name = Products;
-			sourceTree = "<group>";
-		};
-		D3140E092D76240F6A157CCE = {
-			isa = PBXGroup;
-			children = (
-				AF5DA3546C7B12BA141E9508 /* assets */,
-				6BF4C7EB12DBD2E253B2741E /* Assets.xcassets */,
-				B0EAFEFF59AA7CFEF57FA63C /* LaunchScreen.storyboard */,
-				6AE8986BFC081ADF4EF98889 /* Externals */,
-				31943D18956B6AFD5A82AB02 /* maple_iOS */,
-				A278899D6905367F60E00F01 /* Sources */,
-				FF31B258F4FE6CC5B57B4FB8 /* src */,
-				B58B2AB62FA5D8F41C3A031C /* Frameworks */,
-				C312B5C9A1506139452E194B /* Products */,
-			);
-			sourceTree = "<group>";
-		};
-		E5992A2C52DE443515252068 /* maple */ = {
-			isa = PBXGroup;
-			children = (
-				CE20E8A9C4CF149CA9CA485A /* main.mm */,
-				F9E1B0C7AF484C8F6312F2C8 /* bindings */,
-			);
-			path = maple;
-			sourceTree = "<group>";
-		};
-		F9E1B0C7AF484C8F6312F2C8 /* bindings */ = {
-			isa = PBXGroup;
-			children = (
-				7BBAB8D5C4E3D05A4F48B6EA /* bindings.h */,
-			);
-			path = bindings;
-			sourceTree = "<group>";
-		};
-		FF31B258F4FE6CC5B57B4FB8 /* src */ = {
-			isa = PBXGroup;
-			children = (
-				1094B8CB671809878F533CEC /* lib.rs */,
-				C0A332F21EB65CD4B83229DF /* main.rs */,
-			);
-			name = src;
-			path = ../../src;
-			sourceTree = "<group>";
-		};
-/* End PBXGroup section */
-
-/* Begin PBXNativeTarget section */
-		745812EBA5246F9E4CEE1574 /* maple_iOS */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 27939507295816FC37580B40 /* Build configuration list for PBXNativeTarget "maple_iOS" */;
-			buildPhases = (
-				88FF8D973FB9516A2A98CD39 /* Build Rust Code */,
-				6D9F08407F22BE108C77276C /* Sources */,
-				25104604B2C2A81B04543E68 /* Resources */,
-				04F3BEBB04BD927FDC86B255 /* Frameworks */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-			);
-			name = maple_iOS;
-			productName = maple_iOS;
-			productReference = 1DB07799A17353B2E32B65D3 /* Maple.app */;
-			productType = "com.apple.product-type.application";
-		};
-/* End PBXNativeTarget section */
-
-/* Begin PBXProject section */
-		EAA0B11A781B9CD753D1399F /* Project object */ = {
-			isa = PBXProject;
-			attributes = {
-				BuildIndependentTargetsInParallel = YES;
-				LastUpgradeCheck = 1430;
-			};
-			buildConfigurationList = 2FA6FD4DEFE659C96AAB5E5D /* Build configuration list for PBXProject "maple" */;
-			compatibilityVersion = "Xcode 14.0";
-			developmentRegion = en;
-			hasScannedForEncodings = 0;
-			knownRegions = (
-				Base,
-				en,
-			);
-			mainGroup = D3140E092D76240F6A157CCE;
-			projectDirPath = "";
-			projectRoot = "";
-			targets = (
-				745812EBA5246F9E4CEE1574 /* maple_iOS */,
-			);
-		};
-/* End PBXProject section */
-
-/* Begin PBXResourcesBuildPhase section */
-		25104604B2C2A81B04543E68 /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				A120CF155DE2B343CEFFB77C /* Assets.xcassets in Resources */,
-				621A96F6B965E600E714FB6C /* LaunchScreen.storyboard in Resources */,
-				B79EC8A2A1A869B9F38906ED /* assets in Resources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXResourcesBuildPhase section */
-
-/* Begin PBXShellScriptBuildPhase section */
-		88FF8D973FB9516A2A98CD39 /* Build Rust Code */ = {
-			isa = PBXShellScriptBuildPhase;
-			alwaysOutOfDate = 1;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputFileListPaths = (
-			);
-			inputPaths = (
-			);
-			name = "Build Rust Code";
-			outputFileListPaths = (
-			);
-			outputPaths = (
-				"$(SRCROOT)/Externals/x86_64/${CONFIGURATION}/libapp.a",
-				"$(SRCROOT)/Externals/arm64/${CONFIGURATION}/libapp.a",
-				"$(SRCROOT)/Externals/arm64-sim/${CONFIGURATION}/libapp.a",
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "bun tauri ios xcode-script -v --platform ${PLATFORM_DISPLAY_NAME:?} --sdk-root ${SDKROOT:?} --framework-search-paths \"${FRAMEWORK_SEARCH_PATHS:?}\" --header-search-paths \"${HEADER_SEARCH_PATHS:?}\" --gcc-preprocessor-definitions \"${GCC_PREPROCESSOR_DEFINITIONS:-}\" --configuration ${CONFIGURATION:?} ${FORCE_COLOR} ${ARCHS:?}";
-		};
-/* End PBXShellScriptBuildPhase section */
-
-/* Begin PBXSourcesBuildPhase section */
-		6D9F08407F22BE108C77276C /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				9F3ED7EA97AFC22E0B4A6EAF /* main.mm in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXSourcesBuildPhase section */
-
-/* Begin XCBuildConfiguration section */
-		1DE1BEC252AAEF735A07CA8B /* debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
-				ARCHS = (
-					arm64,
-					"arm64-sim",
-				);
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				CODE_SIGN_ENTITLEMENTS = maple_iOS/maple_iOS.entitlements;
-				CODE_SIGN_IDENTITY = "Apple Development";
-				CODE_SIGN_STYLE = Automatic;
-				DEVELOPMENT_TEAM = "X773Y823TN";
-				ENABLE_BITCODE = NO;
-				"EXCLUDED_ARCHS[sdk=iphoneos*]" = "arm64-sim x86_64";
-				"EXCLUDED_ARCHS[sdk=iphonesimulator*]" = arm64;
-				FRAMEWORK_SEARCH_PATHS = (
-					"$(inherited)",
-					"\".\"",
-				);
-				INFOPLIST_FILE = maple_iOS/Info.plist;
-				LD_RUNPATH_SEARCH_PATHS = (
-					"$(inherited)",
-					"@executable_path/Frameworks",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=arm64-sim]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/arm64-sim/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=arm64]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/arm64/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=x86_64]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/x86_64/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				PRODUCT_BUNDLE_IDENTIFIER = cloud.opensecret.maple;
-				PRODUCT_NAME = Maple;
-				PROVISIONING_PROFILE_SPECIFIER = "";
-				SDKROOT = iphoneos;
-				TARGETED_DEVICE_FAMILY = "1,2";
-				VALID_ARCHS = "arm64  arm64-sim";
-			};
-			name = debug;
-		};
-		1E8FE8E2E3063C3FDCD3B5D1 /* debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
-				CLANG_CXX_LIBRARY = "libc++";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = dwarf;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				ENABLE_TESTABILITY = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu11;
-				GCC_DYNAMIC_NO_PIC = NO;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_OPTIMIZATION_LEVEL = 0;
-				GCC_PREPROCESSOR_DEFINITIONS = (
-					"$(inherited)",
-					"DEBUG=1",
-				);
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 13.0;
-				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
-				MTL_FAST_MATH = YES;
-				ONLY_ACTIVE_ARCH = YES;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				SDKROOT = iphoneos;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
-				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
-				SWIFT_VERSION = 5.0;
-			};
-			name = debug;
-		};
-		94ECC2E044AA76E166E0866E /* release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
-				CLANG_CXX_LIBRARY = "libc++";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
-				ENABLE_NS_ASSERTIONS = NO;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu11;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 13.0;
-				MTL_ENABLE_DEBUG_INFO = NO;
-				MTL_FAST_MATH = YES;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				SDKROOT = iphoneos;
-				SWIFT_COMPILATION_MODE = wholemodule;
-				SWIFT_OPTIMIZATION_LEVEL = "-O";
-				SWIFT_VERSION = 5.0;
-			};
-			name = release;
-		};
-		B90C9BEF4885680BFA986CD2 /* release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
-				ARCHS = (
-					arm64,
-					"arm64-sim",
-				);
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				CODE_SIGN_ENTITLEMENTS = maple_iOS/maple_iOS.entitlements;
-				CODE_SIGN_IDENTITY = "Apple Development";
-				CODE_SIGN_STYLE = Automatic;
-				DEVELOPMENT_TEAM = "X773Y823TN";
-				ENABLE_BITCODE = NO;
-				"EXCLUDED_ARCHS[sdk=iphoneos*]" = "arm64-sim x86_64";
-				"EXCLUDED_ARCHS[sdk=iphonesimulator*]" = arm64;
-				FRAMEWORK_SEARCH_PATHS = (
-					"$(inherited)",
-					"\".\"",
-				);
-				INFOPLIST_FILE = maple_iOS/Info.plist;
-				LD_RUNPATH_SEARCH_PATHS = (
-					"$(inherited)",
-					"@executable_path/Frameworks",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=arm64-sim]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/arm64-sim/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=arm64]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/arm64/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=x86_64]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/x86_64/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				PRODUCT_BUNDLE_IDENTIFIER = cloud.opensecret.maple;
-				PRODUCT_NAME = Maple;
-				PROVISIONING_PROFILE_SPECIFIER = "";
-				SDKROOT = iphoneos;
-				TARGETED_DEVICE_FAMILY = "1,2";
-				VALID_ARCHS = "arm64  arm64-sim";
-			};
-			name = release;
-		};
-		EA2669D02DADAA11005A7F4B /* local */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
-				CLANG_CXX_LIBRARY = "libc++";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = dwarf;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				ENABLE_TESTABILITY = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu11;
-				GCC_DYNAMIC_NO_PIC = NO;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_OPTIMIZATION_LEVEL = 0;
-				GCC_PREPROCESSOR_DEFINITIONS = (
-					"$(inherited)",
-					"DEBUG=1",
-				);
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 13.0;
-				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
-				MTL_FAST_MATH = YES;
-				ONLY_ACTIVE_ARCH = YES;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				SDKROOT = iphoneos;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
-				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
-				SWIFT_VERSION = 5.0;
-			};
-			name = local;
-		};
-		EA2669D12DADAA11005A7F4B /* local */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
-				ARCHS = (
-					arm64,
-					"arm64-sim",
-				);
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				CODE_SIGN_ENTITLEMENTS = maple_iOS/maple_iOS.entitlements;
-				CODE_SIGN_IDENTITY = "Apple Development";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
-				CODE_SIGN_STYLE = Manual;
-				DEVELOPMENT_TEAM = "X773Y823TN";
-				"DEVELOPMENT_TEAM[sdk=iphoneos*]" = X773Y823TN;
-				ENABLE_BITCODE = NO;
-				"EXCLUDED_ARCHS[sdk=iphoneos*]" = "arm64-sim x86_64";
-				"EXCLUDED_ARCHS[sdk=iphonesimulator*]" = arm64;
-				FRAMEWORK_SEARCH_PATHS = (
-					"$(inherited)",
-					"\".\"",
-				);
-				INFOPLIST_FILE = maple_iOS/Info.plist;
-				LD_RUNPATH_SEARCH_PATHS = (
-					"$(inherited)",
-					"@executable_path/Frameworks",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=arm64-sim]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/arm64-sim/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=arm64]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/arm64/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=x86_64]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/x86_64/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				PRODUCT_BUNDLE_IDENTIFIER = cloud.opensecret.maple;
-				PRODUCT_NAME = Maple;
-				PROVISIONING_PROFILE_SPECIFIER = "86059ea7-ae8e-44af-8a58-b2ab7c78d299";
-				"PROVISIONING_PROFILE_SPECIFIER[sdk=iphoneos*]" = "86059ea7-ae8e-44af-8a58-b2ab7c78d299";
-				SDKROOT = iphoneos;
-				TARGETED_DEVICE_FAMILY = "1,2";
-				VALID_ARCHS = "arm64  arm64-sim";
-			};
-			name = local;
-		};
-/* End XCBuildConfiguration section */
-
-/* Begin XCConfigurationList section */
-		27939507295816FC37580B40 /* Build configuration list for PBXNativeTarget "maple_iOS" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				1DE1BEC252AAEF735A07CA8B /* debug */,
-				EA2669D12DADAA11005A7F4B /* local */,
-				B90C9BEF4885680BFA986CD2 /* release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = debug;
-		};
-		2FA6FD4DEFE659C96AAB5E5D /* Build configuration list for PBXProject "maple" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				1E8FE8E2E3063C3FDCD3B5D1 /* debug */,
-				EA2669D02DADAA11005A7F4B /* local */,
-				94ECC2E044AA76E166E0866E /* release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = debug;
-		};
-/* End XCConfigurationList section */
-	};
-	rootObject = EAA0B11A781B9CD753D1399F /* Project object */;
-}
diff --git a/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime-all.sh b/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime-all.sh
index 21b6e43c8..0baf7fc9d 100755
--- a/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime-all.sh
+++ b/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime-all.sh
@@ -23,7 +23,7 @@ BUILD_DIR="${TAURI_DIR}/onnxruntime-build"
 OUTPUT_DIR="${TAURI_DIR}/onnxruntime-ios"
 XCFRAMEWORK_DIR="${OUTPUT_DIR}/onnxruntime.xcframework"
 
-IOS_DEPLOYMENT_TARGET="13.0"
+IOS_DEPLOYMENT_TARGET="16.0"
 
 echo "========================================"
 echo "Building ONNX Runtime ${ORT_VERSION} for iOS"
diff --git a/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime.sh b/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime.sh
index de3e38d0e..649e1df11 100755
--- a/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime.sh
+++ b/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime.sh
@@ -24,7 +24,7 @@ OUTPUT_DIR="${TAURI_DIR}/onnxruntime-ios"
 XCFRAMEWORK_DIR="${OUTPUT_DIR}/onnxruntime.xcframework"
 
 # Minimum iOS version to support
-IOS_DEPLOYMENT_TARGET="13.0"
+IOS_DEPLOYMENT_TARGET="16.0"
 
 echo "========================================"
 echo "Building ONNX Runtime ${ORT_VERSION} for iOS"
diff --git a/apps/maple-research/frontend/src-tauri/scripts/onnxruntime-pins.sh b/apps/maple-research/frontend/src-tauri/scripts/onnxruntime-pins.sh
index 51cb644df..ce6b55e44 100644
--- a/apps/maple-research/frontend/src-tauri/scripts/onnxruntime-pins.sh
+++ b/apps/maple-research/frontend/src-tauri/scripts/onnxruntime-pins.sh
@@ -165,11 +165,11 @@ onnxruntime_ios_commit_for_version() {
 }
 
 onnxruntime_ios_device_lib_sha256_for_version() {
-  local xcode_build="${2:-${MAPLE_XCODE_BUILD_VERSION:-17F42}}"
+  local xcode_build="${2:-${MAPLE_XCODE_BUILD_VERSION:-27A9275}}"
 
   case "$1:${xcode_build}" in
-    1.23.2:17F42)
-      printf '%s\n' "917cf5f30aa65f435371e323e347e094c99804fd6a268d3ae946cd8e5e58945f"
+    1.23.2:27A9275)
+      printf '%s\n' "e4d288188f0b520d6676e87ad4a694326a8844618f471b5c8cfcdb69daf66657"
       ;;
     *)
       echo "No pinned ONNX Runtime iOS device library SHA-256 for version '$1' and Xcode build '${xcode_build}'." >&2
@@ -179,11 +179,11 @@ onnxruntime_ios_device_lib_sha256_for_version() {
 }
 
 onnxruntime_ios_simulator_lib_sha256_for_version() {
-  local xcode_build="${2:-${MAPLE_XCODE_BUILD_VERSION:-17F42}}"
+  local xcode_build="${2:-${MAPLE_XCODE_BUILD_VERSION:-27A9275}}"
 
   case "$1:${xcode_build}" in
-    1.23.2:17F42)
-      printf '%s\n' "87c87225026db5ee2b5a1293468b9cc3410ad22eac182899056a05f2f2862071"
+    1.23.2:27A9275)
+      printf '%s\n' "0b670a0fce021844551d7bd9fc0c3c4275208375155e0c17254866215ae28736"
       ;;
     *)
       echo "No pinned ONNX Runtime iOS simulator library SHA-256 for version '$1' and Xcode build '${xcode_build}'." >&2
@@ -193,11 +193,11 @@ onnxruntime_ios_simulator_lib_sha256_for_version() {
 }
 
 onnxruntime_ios_xcframework_sha256_for_version() {
-  local xcode_build="${2:-${MAPLE_XCODE_BUILD_VERSION:-17F42}}"
+  local xcode_build="${2:-${MAPLE_XCODE_BUILD_VERSION:-27A9275}}"
 
   case "$1:${xcode_build}" in
-    1.23.2:17F42)
-      printf '%s\n' "86871fe82fb5b043540d5bbc67de5ba73f2a52105ec05c66e835b7add8972af5"
+    1.23.2:27A9275)
+      printf '%s\n' "93cbb699abebba06963ccf1b5c283ea0bbf7b8e9e4664f9b2df726d2808bf18a"
       ;;
     *)
       echo "No pinned ONNX Runtime iOS xcframework SHA-256 for version '$1' and Xcode build '${xcode_build}'." >&2
diff --git a/apps/maple-research/frontend/src-tauri/tests/storekit/README.md b/apps/maple-research/frontend/src-tauri/tests/storekit/README.md
index 96943c890..e570b3064 100644
--- a/apps/maple-research/frontend/src-tauri/tests/storekit/README.md
+++ b/apps/maple-research/frontend/src-tauri/tests/storekit/README.md
@@ -26,8 +26,9 @@ re-signs/verifies them, and generates the local experiment scheme. Source plist
 and entitlements are restored. Preserve the existing frozen artifact when
 comparing toolchains; rebuilding Maple is a separate action.
 
-These test commands explicitly select installed Xcode 26.6 **after entering** the
-pinned Apple shell, without changing repository pins or global Xcode selection.
+These test commands use the Xcode selected by the pinned Apple shell
+(`scripts/ci/apple-toolchain.json`). The dated notes below record earlier runs on
+Xcode 26.5 and 26.6.
 Use `run.sh`, which prepares native linker variables; do not invoke `run.py`
 directly from an unprepared Nix shell. Substitute the exact frozen app path and
 intended simulator UDID when different from these examples.
@@ -35,9 +36,7 @@ intended simulator UDID when different from these examples.
 First build the small runner and run the catalog canary, which needs no fixture:
 
 ```sh
-nix develop --no-update-lock-file .#apple -c env \
-  MAPLE_NIX_XCODE_VERSION=26.6 MAPLE_NIX_XCODE_BUILD_VERSION=17F113 \
-  DEVELOPER_DIR=/Applications/Xcode_26.6.app/Contents/Developer \
+nix develop --no-update-lock-file .#apple -c \
   bash scripts/testing/storekit/run.sh \
   --app apps/maple-research/frontend/src-tauri/gen/apple/build/arm64-sim/Maple.app \
   --udid "<YOUR_BOOTED_SIMULATOR_UDID>" \
@@ -47,9 +46,7 @@ nix develop --no-update-lock-file .#apple -c env \
 Then run the certificate canary with a fresh runner-owned bootstrap fixture:
 
 ```sh
-nix develop --no-update-lock-file .#apple -c env \
-  MAPLE_NIX_XCODE_VERSION=26.6 MAPLE_NIX_XCODE_BUILD_VERSION=17F113 \
-  DEVELOPER_DIR=/Applications/Xcode_26.6.app/Contents/Developer \
+nix develop --no-update-lock-file .#apple -c \
   bash scripts/testing/storekit/run.sh --skip-build --fixture-bootstrap \
   --app apps/maple-research/frontend/src-tauri/gen/apple/build/arm64-sim/Maple.app \
   --udid "<YOUR_BOOTED_SIMULATOR_UDID>" \
@@ -69,9 +66,7 @@ Pass that certificate to the remaining cases. They reuse the runner build but
 each gets a separate XCTest invocation, fixture process and journal:
 
 ```sh
-nix develop --no-update-lock-file .#apple -c env \
-  MAPLE_NIX_XCODE_VERSION=26.6 MAPLE_NIX_XCODE_BUILD_VERSION=17F113 \
-  DEVELOPER_DIR=/Applications/Xcode_26.6.app/Contents/Developer \
+nix develop --no-update-lock-file .#apple -c \
   bash scripts/testing/storekit/run.sh --skip-build \
   --fixture-certificate /absolute/path/to/MapleStoreKitSigningCertificate.cer \
   --app apps/maple-research/frontend/src-tauri/gen/apple/build/arm64-sim/Maple.app \
@@ -175,9 +170,7 @@ To export metadata from an already running purchased diagnostic screen without
 reinstalling or restarting Maple, pass the exact GUI-built DerivedData app:
 
 ```sh
-nix develop --no-update-lock-file .#apple -c env \
-  MAPLE_NIX_XCODE_VERSION=26.6 MAPLE_NIX_XCODE_BUILD_VERSION=17F113 \
-  DEVELOPER_DIR=/Applications/Xcode_26.6.app/Contents/Developer \
+nix develop --no-update-lock-file .#apple -c \
   bash scripts/testing/storekit/run.sh --app /absolute/path/to/Maple.app \
   --udid "<YOUR_BOOTED_SIMULATOR_UDID>" \
   --only MapleStoreKitCaptureUITests/testExportPublicSigningCertificate
@@ -202,7 +195,7 @@ The exact Foundation-only parser can also be checked on the host, without
 building an app or operating a simulator:
 
 ```sh
-DEVELOPER_DIR=/Applications/Xcode_26.6.app/Contents/Developer \
+DEVELOPER_DIR=/Applications/Xcode_27.1.app/Contents/Developer \
   python3 scripts/testing/storekit/check-snapshot-parser.py
 ```
 
diff --git a/docs/ci.md b/docs/ci.md
index 1eba71e17..61f207d2c 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -169,7 +169,7 @@ org's 16-core GitHub runner are billed by the minute.
 
 | Runner | Lanes | Why |
 | --- | --- | --- |
-| `blacksmith-8vcpu-ubuntu-2404`, `blacksmith-6vcpu-macos-26`, `blacksmith-8vcpu-windows-2025` | Most compiling lanes, for example Research Rust, OpenSecret Rust, every macOS lane and the Agent's Windows Clippy | Fast, with warm caches in Blacksmith's store |
+| `blacksmith-8vcpu-ubuntu-2404`, `blacksmith-6vcpu-macos-27`, `blacksmith-8vcpu-windows-2025` | Most compiling lanes, for example Research Rust, OpenSecret Rust, every macOS lane and the Agent's Windows Clippy | Fast, with warm caches in Blacksmith's store |
 | `blacksmith-32vcpu-ubuntu-2404` | `agent-lint`, `agent-test` | The heaviest cold builds |
 | `ubuntu-latest`, `ubuntu-24.04-arm` | Lighter lanes, for example `repo`, SDK, proxy, Research web, services, `deps-*` and `os-pcr` | Free, and fast enough without Blacksmith |
 | `windows-2025` | `agent-windows-updater`, `agent-full-windows` | Blacksmith's Windows workspace inherits a foreign write ACE that the updater's storage validation rejects, and the reparse tests need the symlink privilege GitHub's runner grants |
diff --git a/docs/repository-workflows.md b/docs/repository-workflows.md
index 8eec5ddde..5cc96d853 100644
--- a/docs/repository-workflows.md
+++ b/docs/repository-workflows.md
@@ -247,7 +247,7 @@ release workflows use:
 
 | Work | Runner |
 | --- | --- |
-| Research macOS, Linux, Android and iOS builds, which compile and sign (master and release); `rust-tests.yml`; the Agent's unsigned master builds | Blacksmith (`blacksmith-6vcpu-macos-26`, `blacksmith-8vcpu-ubuntu-2404`, `blacksmith-8vcpu-windows-2025`) |
+| Research macOS, Linux, Android and iOS builds, which compile and sign (master and release); `rust-tests.yml`; the Agent's unsigned master builds | Blacksmith (`blacksmith-6vcpu-macos-27`, `blacksmith-8vcpu-ubuntu-2404`, `blacksmith-8vcpu-windows-2025`) |
 | Release `build-windows` | `maple-windows-2025-16core` |
 | Signed Research Windows master build; Agent Windows signing and verification | `windows-2025` |
 | Artifact verifiers, TestFlight submission, the Agent's signing and attestation, CodeQL, web and frontend evidence | Other GitHub-hosted runners |
@@ -268,7 +268,7 @@ PowerShell Gallery and its CDN and accepts only the pinned SHA-256. Rust,
 MSVC, Perl and the linker are pinned by `.github/actions/setup-agent-windows`
 for the Agent.
 
-Research desktop and iOS builds select Xcode 26.5 (`17F42`) from
+Research desktop and iOS builds select Xcode 27.1 (`27A9275`) from
 [`scripts/ci/apple-toolchain.json`](../scripts/ci/apple-toolchain.json) through
 `scripts/ci/select-xcode.py`; the root Nix shell exports the same version for
 its Apple recipes. Do not rely on a runner's default Xcode. The
diff --git a/scripts/ci/_common.sh b/scripts/ci/_common.sh
index 046293ea3..6736b1e31 100755
--- a/scripts/ci/_common.sh
+++ b/scripts/ci/_common.sh
@@ -2814,7 +2814,7 @@ verify_ios_onnxruntime_pinned_hashes() {
   local version xcode_build xcframework manifest file expected actual status
 
   version="$(ios_onnxruntime_version)"
-  xcode_build="${MAPLE_XCODE_BUILD_VERSION:-17F42}"
+  xcode_build="${MAPLE_XCODE_BUILD_VERSION:-27A9275}"
   xcframework="$(ios_onnxruntime_xcframework_dir)"
   manifest="$(ios_onnxruntime_manifest_file)"
   status=0
diff --git a/scripts/ci/apple-toolchain.json b/scripts/ci/apple-toolchain.json
index 8f2cd86e1..9aa97b351 100644
--- a/scripts/ci/apple-toolchain.json
+++ b/scripts/ci/apple-toolchain.json
@@ -1,4 +1,4 @@
 {
-  "version": "26.5",
-  "build": "17F42"
+  "version": "27.1",
+  "build": "27A9275"
 }
diff --git a/scripts/ci/lanes.py b/scripts/ci/lanes.py
index d71ca362c..d56a1e3dc 100644
--- a/scripts/ci/lanes.py
+++ b/scripts/ci/lanes.py
@@ -36,7 +36,7 @@ def cache_store(label: str) -> str:
 # The override variables are unset; set one to fail over during an outage.
 LINUX = Runner("blacksmith-8vcpu-ubuntu-2404", "CI_LINUX_RUNNER")
 LINUX_HEAVY = Runner("blacksmith-32vcpu-ubuntu-2404", "CI_LINUX_HEAVY_RUNNER")
-MACOS = Runner("blacksmith-6vcpu-macos-26", "CI_MACOS_RUNNER")
+MACOS = Runner("blacksmith-6vcpu-macos-27", "CI_MACOS_RUNNER")
 WINDOWS = Runner("blacksmith-8vcpu-windows-2025", "CI_WINDOWS_RUNNER")
 GITHUB = Runner("ubuntu-latest")  # free GitHub runner for lanes that compile nothing heavy
 # The Agent updater's native Windows tests and the installer smoke test need GitHub's
diff --git a/scripts/testing/storekit/run.sh b/scripts/testing/storekit/run.sh
index 812b01f14..e0ac66d1a 100644
--- a/scripts/testing/storekit/run.sh
+++ b/scripts/testing/storekit/run.sh
@@ -2,10 +2,11 @@
 set -euo pipefail
 
 # Invoke through .#apple so native linker variables are prepared here.
-# A deliberate local comparison can select Xcode 26.6 without changing pins:
+# A deliberate local comparison can select another installed Xcode without
+# changing pins:
 # nix develop --no-update-lock-file .#apple -c env \
-#   MAPLE_NIX_XCODE_VERSION=26.6 MAPLE_NIX_XCODE_BUILD_VERSION=17F113 \
-#   DEVELOPER_DIR=/Applications/Xcode_26.6.app/Contents/Developer \
+#   MAPLE_NIX_XCODE_VERSION=<version> MAPLE_NIX_XCODE_BUILD_VERSION=<build> \
+#   DEVELOPER_DIR=/Applications/Xcode_<version>.app/Contents/Developer \
 #   bash scripts/testing/storekit/run.sh ...
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")/../../ci" && pwd)/_common.sh"
 use_xcode_toolchain

From 840d8d78f152cea3ddb94d88e05b67c2c49df3ed Mon Sep 17 00:00:00 2001
From: Anthony Ronning <101225832+AnthonyRonning@users.noreply.github.com>
Date: Thu, 29 Oct 2026 02:57:17 +0000
Subject: [PATCH 4/6] ci: compile Agent Metal shaders on Blacksmith macOS 27

Blacksmith's macOS 27 image has no Metal Toolchain for Xcode 27.1 and
cannot download it (the MobileAsset catalog fetch fails), while GitHub's
xcode-27 image ships it.

- A new export runs on xcode-27 and uploads the toolchain as a one-day
  artifact (.github/actions/export-metal-toolchain). The jobs that
  compile gpui's shaders import it (import-metal-toolchain): the signed
  macOS build in agent-desktop-build.yml and, in ci.yml, the macOS
  packaging rehearsal.
- Lanes gain `requires`. The planner adds a required lane to every plan
  that selects the lane requiring it, dispatches included, so
  metal-toolchain runs exactly when agent-package-macos does. lint
  checks that requirements exist, form no cycle, select nothing on their
  own, and that the requiring job needs them.
- agent-macos (PR Clippy) and agent-full-macos (the native suite) build
  gpui with runtime_shaders and need no Metal. Compiled shaders are
  proven by master's signed Prod build on every Agent push, the nightly
  Dev build and ci:package. Toolchain changes now also select
  agent-full-macos on master.
- Cache keys include the Xcode pin, so an upgrade never restores objects
  built against the previous SDK: the macOS lanes' cache_files, the
  packaging rehearsal's key prefix, and the signed build's release key
  (cargo_graph_key.py takes optional pin files; C4 expects the pin for
  macos-build only, so the Windows and Linux keys are unchanged).
- The policy tests know GitHub's per-Xcode labels are GitHub-hosted, so
  the attesting signing job may run on xcode-27.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../change-maple-ci/references/changing-ci.md | 13 +++++-
 .../actions/export-metal-toolchain/action.yml | 28 ++++++++++++
 .../actions/import-metal-toolchain/action.yml | 30 +++++++++++++
 .github/workflows/agent-desktop-build.yml     | 25 ++++++++++-
 .github/workflows/ci.yml                      | 26 +++++++++--
 docs/ci.md                                    |  4 +-
 docs/repository-workflows.md                  |  6 ++-
 scripts/ci/cargo_graph_key.py                 | 19 +++++---
 scripts/ci/lanes.py                           | 35 +++++++++++----
 scripts/ci/plan.py                            | 44 ++++++++++++++++++-
 scripts/ci/test_cargo_graph_key.py            | 19 ++++++++
 scripts/ci/test_contracts.py                  | 17 +++++--
 scripts/ci/test_plan.py                       | 42 ++++++++++++++++++
 scripts/ci/test_workflow_policy.py            |  4 +-
 14 files changed, 280 insertions(+), 32 deletions(-)
 create mode 100644 .github/actions/export-metal-toolchain/action.yml
 create mode 100644 .github/actions/import-metal-toolchain/action.yml

diff --git a/.agents/skills/change-maple-ci/references/changing-ci.md b/.agents/skills/change-maple-ci/references/changing-ci.md
index d1c7c8cb1..7fcefe334 100644
--- a/.agents/skills/change-maple-ci/references/changing-ci.md
+++ b/.agents/skills/change-maple-ci/references/changing-ci.md
@@ -23,6 +23,7 @@ Paths are relative to the repository root. `scripts/ci/lanes.py` and
 | `submodules` | Recursive submodules with full blobless history (Nix needs `revCount`) |
 | `hook` | Pre-commit component that runs the same checks locally |
 | `restore` | Read-only restore of a cache another workflow writes |
+| `requires` | Lanes whose jobs this lane's special job needs. The planner adds them to every plan that selects the lane, dispatches included; a required lane has no paths, labels or gate of its own, so nothing else selects it (lint). `metal-toolchain` is the example: GitHub's xcode-27 image exports Xcode's Metal Toolchain for `agent-package-macos` |
 
 Event sets:
 
@@ -99,6 +100,8 @@ Its id is the lane's `job`. Checked by `plan.py lint` and the policy tests:
 - `runs-on` exactly `${{ vars.<VARIABLE> || '<label>' }}` when the runner has
   an override variable, otherwise the plain label; `timeout-minutes` equals
   the lane's `timeout` (lint).
+- A lane with `requires` has its own job, whose `needs:` lists each required
+  lane's job (lint).
 - `ci-ok` needs it (test 8); a new runner label is declared in
   `.github/actionlint.yaml` (test 9 and lint); checkouts use
   `persist-credentials: false` (test 3).
@@ -132,7 +135,7 @@ The `Runner` constants at the top of `lanes.py` are authoritative.
 | `MACOS` (Blacksmith macOS) | `CI_MACOS_RUNNER` |
 | `WINDOWS` (Blacksmith Windows) | `CI_WINDOWS_RUNNER` |
 | `GITHUB_WINDOWS` (`maple-windows-2025-16core`) | `CI_WINDOWS_GITHUB_RUNNER`, read only by special jobs |
-| `GITHUB`, `GITHUB_WINDOWS_FREE`, `EIF_BUILDER`, inline `ubuntu-24.04-arm` | none |
+| `GITHUB`, `GITHUB_WINDOWS_FREE`, `GITHUB_XCODE` (`xcode-27`), `EIF_BUILDER`, inline `ubuntu-24.04-arm` | none |
 
 - Matrix lanes resolve their runner when `plan` runs. A new matrix variable
   must be passed in the `plan` step's `env`; `lint` checks this.
@@ -159,7 +162,10 @@ The `Runner` constants at the top of `lanes.py` are authoritative.
 - The Agent release key's hash is a step output from
   `scripts/ci/cargo_graph_key.py`, not `hashFiles`. C4 runs that step, with
   the script working and failing, so an empty or misnamed output cannot turn
-  the exact key into a family prefix.
+  the exact key into a family prefix. The macOS build also passes
+  `scripts/ci/apple-toolchain.json`, as the macOS lanes list it in
+  `cache_files`: an Xcode upgrade must not restore objects built against the
+  previous SDK.
 - Turn off implicit saves on PR paths: setup-bun `no-cache: true` and no
   Magic Nix Cache (both checked), and Trivy `cache: "false"` (convention).
 - After a lockfile change, master's first save deletes the lane's target
@@ -252,6 +258,9 @@ selected or nightly; run it yourself after doc edits.
 `just lane <id>` runs exactly what CI runs. Limits:
 
 - macOS lanes need macOS and the pinned Xcode (`scripts/ci/select-xcode.py`).
+  The Agent's Clippy and native suite build gpui with `runtime_shaders`, so
+  they need no Metal Toolchain; the packaging rehearsal compiles the shaders
+  and needs it (`xcodebuild -downloadComponent MetalToolchain`).
 - Windows lanes need Windows with the toolchain from
   `.github/actions/setup-agent-windows`.
 - `os-sdk-e2e` needs PostgreSQL on `127.0.0.1:5432` with the credentials in
diff --git a/.github/actions/export-metal-toolchain/action.yml b/.github/actions/export-metal-toolchain/action.yml
new file mode 100644
index 000000000..0bd6651b9
--- /dev/null
+++ b/.github/actions/export-metal-toolchain/action.yml
@@ -0,0 +1,28 @@
+name: Export the Metal Toolchain
+description: >-
+  Download the selected Xcode's Metal Toolchain and upload it as this run's
+  one-day `metal-toolchain` artifact. Blacksmith's macOS image has no Metal
+  Toolchain and cannot download it (its MobileAsset catalog fetch fails), so a
+  GitHub xcode-27 job exports it and the Blacksmith jobs import it. Run it after
+  selecting the pinned Xcode.
+runs:
+  using: composite
+  steps:
+    - name: Download and export the Metal Toolchain
+      shell: bash
+      run: |
+        set -euo pipefail
+        export_dir="$RUNNER_TEMP/metal-toolchain"
+        mkdir -p "$export_dir"
+        xcodebuild -downloadComponent metalToolchain -exportPath "$export_dir"
+        # Keep symlinks and modes intact; artifacts flatten them.
+        tar -C "$export_dir" -cf "$RUNNER_TEMP/metal-toolchain.tar" .
+    - name: Upload the Metal Toolchain
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      with:
+        name: metal-toolchain
+        path: ${{ runner.temp }}/metal-toolchain.tar
+        if-no-files-found: error
+        # Apple's toolchain, re-hosted only for this run's jobs.
+        retention-days: 1
+        compression-level: 0
diff --git a/.github/actions/import-metal-toolchain/action.yml b/.github/actions/import-metal-toolchain/action.yml
new file mode 100644
index 000000000..4454e1b10
--- /dev/null
+++ b/.github/actions/import-metal-toolchain/action.yml
@@ -0,0 +1,30 @@
+name: Import the Metal Toolchain
+description: >-
+  Install the Metal Toolchain that this run's metal-toolchain job exported, so
+  gpui can compile its Metal shaders on Blacksmith's macOS image. A runner whose
+  Xcode already has it (GitHub's xcode-27 image, during a failover) skips the
+  import. Run it after selecting the pinned Xcode.
+runs:
+  using: composite
+  steps:
+    - name: Download the exported Metal Toolchain
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      with:
+        name: metal-toolchain
+        path: ${{ runner.temp }}/metal-toolchain-artifact
+    - name: Import the Metal Toolchain
+      shell: bash
+      run: |
+        set -euo pipefail
+        if xcodebuild -showComponent metalToolchain | grep -q '^Status: installed'; then
+          echo "The selected Xcode already has its Metal Toolchain."
+        else
+          import_dir="$RUNNER_TEMP/metal-toolchain"
+          mkdir -p "$import_dir"
+          tar -C "$import_dir" -xf "$RUNNER_TEMP/metal-toolchain-artifact/metal-toolchain.tar"
+          bundle="$(find "$import_dir" -maxdepth 1 \( -name '*.exportedBundle' -o -name '*.dmg' \) -print -quit)"
+          test -n "$bundle"
+          xcodebuild -importComponent metalToolchain -importPath "$bundle" \
+            || sudo xcodebuild -importComponent metalToolchain -importPath "$bundle"
+        fi
+        xcrun -sdk macosx metal --version
diff --git a/.github/workflows/agent-desktop-build.yml b/.github/workflows/agent-desktop-build.yml
index 266dd2440..cb994738e 100644
--- a/.github/workflows/agent-desktop-build.yml
+++ b/.github/workflows/agent-desktop-build.yml
@@ -51,9 +51,29 @@ jobs:
         # Dispatch, the nightly run, an unusable push base and selector errors all build.
         run: python3 scripts/ci/plan.py only agent-desktop >> "$GITHUB_OUTPUT"
 
+  # Blacksmith's macOS image cannot download Xcode's Metal Toolchain, so GitHub's
+  # xcode-27 image exports it for the macOS build, which compiles gpui's shaders.
+  metal-toolchain:
+    name: Export the Metal Toolchain
+    needs: changes
+    if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.agent != 'false') && github.repository == 'MaplePrivacyLabs/Maple' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule') }}
+    runs-on: xcode-27
+    permissions:
+      contents: read
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - name: Select pinned Xcode
+        working-directory: .
+        run: python3 scripts/ci/select-xcode.py
+      - uses: ./.github/actions/export-metal-toolchain
+
   macos-build:
     name: Build macOS binary (${{ matrix.variant }})
-    needs: changes
+    needs: [changes, metal-toolchain]
     if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.agent != 'false') && github.repository == 'MaplePrivacyLabs/Maple' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule') }}
     runs-on: blacksmith-6vcpu-macos-27
     permissions:
@@ -82,9 +102,10 @@ jobs:
       - name: Select pinned Xcode
         working-directory: .
         run: python3 scripts/ci/select-xcode.py
+      - uses: ./.github/actions/import-metal-toolchain
       - name: Hash the Agent's third-party dependency graph and toolchain
         id: graph
-        run: python3 ../../scripts/ci/cargo_graph_key.py Cargo.lock flake.lock >> "$GITHUB_OUTPUT"
+        run: python3 ../../scripts/ci/cargo_graph_key.py Cargo.lock flake.lock ../../scripts/ci/apple-toolchain.json >> "$GITHUB_OUTPUT"
       - name: Restore the exact-key Agent release cache
         id: cache
         uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1766b3420..a11591c1c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -229,9 +229,25 @@ jobs:
           if-no-files-found: error
           retention-days: 7
 
+  # Blacksmith's macOS image cannot download Xcode's Metal Toolchain, so GitHub's
+  # xcode-27 image exports it for the lanes that compile gpui's shaders.
+  metal-toolchain:
+    name: metal-toolchain
+    needs: plan
+    if: fromJSON(needs.plan.outputs.lanes)['metal-toolchain']
+    runs-on: xcode-27
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - name: Select pinned Xcode
+        run: python3 scripts/ci/select-xcode.py
+      - uses: ./.github/actions/export-metal-toolchain
+
   agent-package-macos:
     name: agent-package-macos
-    needs: plan
+    needs: [plan, metal-toolchain]
     if: fromJSON(needs.plan.outputs.lanes)['agent-package-macos']
     runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-27' }}
     timeout-minutes: 60
@@ -242,13 +258,15 @@ jobs:
       - uses: ./.github/actions/setup-nix
       - name: Select pinned Xcode
         run: python3 scripts/ci/select-xcode.py
+      - uses: ./.github/actions/import-metal-toolchain
       - name: Restore the packaging rehearsal cache
         id: package-cache
         uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           # Thin-LTO release artifacts; master's fat-LTO cache cannot serve them.
-          key: ci-v1-agent-package-${{ runner.os }}-${{ hashFiles('apps/maple-agent/flake.lock', 'apps/maple-agent/Cargo.lock') }}
-          restore-keys: ci-v1-agent-package-${{ runner.os }}-
+          # The Xcode pin leads, so a prefix restore never brings back another SDK's objects.
+          key: ci-v1-agent-package-${{ runner.os }}-${{ hashFiles('scripts/ci/apple-toolchain.json') }}-${{ hashFiles('apps/maple-agent/flake.lock', 'apps/maple-agent/Cargo.lock') }}
+          restore-keys: ci-v1-agent-package-${{ runner.os }}-${{ hashFiles('scripts/ci/apple-toolchain.json') }}-
           path: |
             ~/.cargo/registry/index
             ~/.cargo/registry/cache
@@ -655,7 +673,7 @@ jobs:
   ci-ok:
     name: ci-ok
     if: always()
-    needs: [plan, nix, windows, agent-package-linux, agent-package-macos, agent-package-windows, research-rust,
+    needs: [plan, nix, windows, agent-package-linux, metal-toolchain, agent-package-macos, agent-package-windows, research-rust,
             research-ios, research-desktop-macos, research-desktop-linux, research-desktop-windows,
             research-dev-macos, os-sdk-e2e, os-helpers, os-eif]
     runs-on: ubuntu-latest
diff --git a/docs/ci.md b/docs/ci.md
index 61f207d2c..ed1c2d8d2 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -94,7 +94,8 @@ later push runs the labelled lanes again until the label is removed.
 `just lane <id>` (the same as `python3 scripts/ci/plan.py run <id>`) runs the
 lane's command in its pinned Nix shell, exactly as `ci.yml` does. macOS lanes
 need macOS and use its selected Xcode (CI pins it with
-`scripts/ci/select-xcode.py`), Windows lanes need Windows with the toolchain
+`scripts/ci/select-xcode.py`; only the packaging rehearsal also needs its Metal
+Toolchain), Windows lanes need Windows with the toolchain
 from `.github/actions/setup-agent-windows`, `os-sdk-e2e` needs PostgreSQL on
 `127.0.0.1:5432` with the credentials in `scripts/ci/opensecret-sdk-e2e.sh`,
 `os-helpers` needs Docker that builds `linux/arm64`, and `os-eif` needs Linux
@@ -171,6 +172,7 @@ org's 16-core GitHub runner are billed by the minute.
 | --- | --- | --- |
 | `blacksmith-8vcpu-ubuntu-2404`, `blacksmith-6vcpu-macos-27`, `blacksmith-8vcpu-windows-2025` | Most compiling lanes, for example Research Rust, OpenSecret Rust, every macOS lane and the Agent's Windows Clippy | Fast, with warm caches in Blacksmith's store |
 | `blacksmith-32vcpu-ubuntu-2404` | `agent-lint`, `agent-test` | The heaviest cold builds |
+| `xcode-27` | `metal-toolchain` | GitHub's Xcode 27 image ships Xcode's Metal Toolchain, which Blacksmith's macOS image lacks and cannot download; it exports it for the macOS packaging rehearsal, the only lane that compiles gpui's shaders. The Agent's other macOS lanes build with runtime shaders |
 | `ubuntu-latest`, `ubuntu-24.04-arm` | Lighter lanes, for example `repo`, SDK, proxy, Research web, services, `deps-*` and `os-pcr` | Free, and fast enough without Blacksmith |
 | `windows-2025` | `agent-windows-updater`, `agent-full-windows` | Blacksmith's Windows workspace inherits a foreign write ACE that the updater's storage validation rejects, and the reparse tests need the symlink privilege GitHub's runner grants |
 | `maple-windows-2025-16core` | `agent-package-windows` (its install smoke needs GitHub's image), `research-desktop-windows` (for speed) | Same image and cache store as `windows-2025`, with more cores |
diff --git a/docs/repository-workflows.md b/docs/repository-workflows.md
index 5cc96d853..750582ccb 100644
--- a/docs/repository-workflows.md
+++ b/docs/repository-workflows.md
@@ -274,7 +274,11 @@ Research desktop and iOS builds select Xcode 27.1 (`27A9275`) from
 its Apple recipes. Do not rely on a runner's default Xcode. The
 [iOS ONNX pins](../apps/maple-research/frontend/src-tauri/scripts/onnxruntime-pins.sh)
 verify artifacts against that exact build, so an Xcode upgrade means rebuilding
-and reviewing those hashes and validating desktop and iOS packaging. A newer
+and reviewing those hashes and validating desktop and iOS packaging. The
+Agent's signed macOS build compiles gpui's Metal shaders: Blacksmith's macOS
+image has no Metal Toolchain and cannot download one, so a GitHub `xcode-27`
+job exports it as a one-day artifact that the build imports, and the build's
+release cache key hashes the Xcode pin. A newer
 CI image does not raise the shipped deployment targets: Research supports
 macOS 13.4 and iOS 16.0.
 
diff --git a/scripts/ci/cargo_graph_key.py b/scripts/ci/cargo_graph_key.py
index 541541bd7..21e0906ef 100644
--- a/scripts/ci/cargo_graph_key.py
+++ b/scripts/ci/cargo_graph_key.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Hash a Cargo.lock's dependency graph and a flake.lock for an exact cache key.
+"""Hash a Cargo.lock's dependency graph, a flake.lock and toolchain pins for an exact cache key.
 
 agent-desktop-build.yml keys its release cache on this hash. Every third-party
 package's name, version, source and checksum, every dependency edge, and the
@@ -7,7 +7,9 @@
 packages, the ones without a `source` (workspace members and path
 dependencies), are dropped, wherever they appear: a release version bump keeps
 the key, while any other change gives a new one. Cargo rebuilds local packages
-anyway.
+anyway. Further arguments are toolchain pin files hashed as text: the macOS build
+passes scripts/ci/apple-toolchain.json, so an Xcode upgrade never restores
+objects built against the previous SDK. Without them the key is unchanged.
 
 Prints `hash=<sha256>` for $GITHUB_OUTPUT. Input it cannot resolve
 unambiguously fails with no output.
@@ -20,6 +22,7 @@
 from pathlib import Path
 import re
 import sys
+from typing import Sequence
 
 try:
     import tomllib
@@ -147,10 +150,12 @@ def parse_flake_lock(text: str) -> dict:
     return flake
 
 
-def key(cargo_lock: str, flake_lock: str) -> str:
-    """SHA-256 of the normalized Cargo.lock graph and the parsed flake.lock."""
+def key(cargo_lock: str, flake_lock: str, pins: Sequence[str] = ()) -> str:
+    """SHA-256 of the normalized Cargo.lock graph, the parsed flake.lock and any pin texts."""
     payload = {"schema": SCHEMA, "cargo": graph(parse_cargo_lock(cargo_lock)),
                "flake": parse_flake_lock(flake_lock)}
+    if pins:
+        payload["pins"] = [text.replace("\r\n", "\n") for text in pins]
     try:
         canonical = json.dumps(payload, sort_keys=True, separators=(",", ":"), ensure_ascii=True)
     except TypeError as error:  # a TOML date or time, which Cargo never writes
@@ -159,12 +164,12 @@ def key(cargo_lock: str, flake_lock: str) -> str:
 
 
 def main(argv: list) -> int:
-    if len(argv) != 2:
-        print("usage: cargo_graph_key.py CARGO_LOCK FLAKE_LOCK", file=sys.stderr)
+    if len(argv) < 2:
+        print("usage: cargo_graph_key.py CARGO_LOCK FLAKE_LOCK [PIN ...]", file=sys.stderr)
         return 2
     try:
         texts = [Path(name).read_text(encoding="utf-8") for name in argv]
-        digest = key(*texts)
+        digest = key(texts[0], texts[1], texts[2:])
     except (OSError, UnicodeError, GraphError) as error:
         print(f"::error::cargo_graph_key.py: {error}", file=sys.stderr)
         return 1
diff --git a/scripts/ci/lanes.py b/scripts/ci/lanes.py
index d56a1e3dc..fd50e7bcc 100644
--- a/scripts/ci/lanes.py
+++ b/scripts/ci/lanes.py
@@ -39,6 +39,9 @@ def cache_store(label: str) -> str:
 MACOS = Runner("blacksmith-6vcpu-macos-27", "CI_MACOS_RUNNER")
 WINDOWS = Runner("blacksmith-8vcpu-windows-2025", "CI_WINDOWS_RUNNER")
 GITHUB = Runner("ubuntu-latest")  # free GitHub runner for lanes that compile nothing heavy
+# GitHub's Xcode 27 image ships Xcode's Metal Toolchain, which Blacksmith's macOS image
+# lacks and cannot download (its MobileAsset catalog fetch fails).
+GITHUB_XCODE = Runner("xcode-27")
 # The Agent updater's native Windows tests and the installer smoke test need GitHub's
 # runner: Blacksmith's workspace inherits a foreign write ACE the updater rejects, and
 # master's Windows install smoke (agent-desktop-build.yml verify-windows) runs there too.
@@ -144,6 +147,7 @@ class Lane:
     submodules: bool = False                    # check out submodules, with the full (blobless) history Nix needs
     hook: Optional[str] = None                  # the pre-commit component that runs these checks
     restore: str = ""                           # read-only restore of a cache another workflow writes
+    requires: Tuple[str, ...] = ()              # lanes whose jobs this lane's job needs; selected with it
 
 
 AGENT_DIR = dict(
@@ -152,6 +156,14 @@ class Lane:
     env=(("RUSTFLAGS", "-D warnings"),),
 )
 AGENT_FLAKE = dict(flake="./apps/maple-agent", **AGENT_DIR)
+# The macOS lanes also key their caches on the Xcode pin, so an Xcode upgrade never
+# restores objects built against the previous SDK.
+AGENT_MACOS = dict(AGENT_FLAKE, runner=MACOS,
+                   cache_files=AGENT_DIR["cache_files"] + ("scripts/ci/apple-toolchain.json",))
+# gpui compiles its Metal shaders at run time instead of build time, so these lanes need
+# no Metal Toolchain (Blacksmith's macOS image has none). Compiled shaders are proven by
+# master's signed Prod build on every Agent push, the nightly Dev build and ci:package.
+RUNTIME_SHADERS = "-F gpui-platform/runtime_shaders"
 # Lanes that only resolve the Agent's graph share its Cargo home, without a target
 # directory, so they stop cloning the zed and cua git dependencies on every run.
 AGENT_CARGO_HOME = dict(AGENT_FLAKE, cache="agent-cargo-home", cache_targets=False)
@@ -220,8 +232,8 @@ def deny(manifest: str, component: str) -> str:
     Lane("agent-test", AGENT, also=RUST_SDK + PROXY_RUNTIME, runner=LINUX_HEAVY,
          run="just ci-test", cache="agent-test", timeout=40, hook="agent", **AGENT_FLAKE),
     Lane("agent-macos", AGENT, also=RUST_SDK + PROXY_RUNTIME + APPLE_TOOLCHAIN,
-         runner=MACOS, run="cargo clippy --workspace --all-targets --locked -- -D warnings",
-         cache="agent-macos", timeout=25, **AGENT_FLAKE),
+         run=f"cargo clippy --workspace --all-targets --locked {RUNTIME_SHADERS} -- -D warnings",
+         cache="agent-macos", timeout=25, **AGENT_MACOS),
     # Windows Clippy and the native PE-metadata and host-spawn fixtures, on every Agent change.
     Lane("agent-windows", AGENT, also=RUST_SDK + PROXY_RUNTIME + ("scripts/ci/agent_windows.py",),
          labels=("ci:windows", "ci:full"),
@@ -235,13 +247,15 @@ def deny(manifest: str, component: str) -> str:
     Lane("agent-windows-updater", AGENT_WINDOWS_UPDATER, labels=("ci:windows", "ci:full"),
          run="cargo test -p maple-agent-updater --locked --no-fail-fast -- --test-threads=1",
          cache="agent-windows-updater", timeout=30, **dict(AGENT_WIN, runner=GITHUB_WINDOWS_FREE)),
-    # The rest of `just ci` and the native macOS suite: master, nightly and ci:full.
+    # The rest of `just ci` and the native macOS suite (with runtime shaders, see
+    # RUNTIME_SHADERS): master, nightly and ci:full.
     Lane("agent-full-linux", AGENT, also=RUST_SDK + PROXY_RUNTIME, pr_paths=(), run="just ci-extra",
          cache="agent-full-linux", timeout=30, gate=False, **AGENT_FLAKE),
-    Lane("agent-full-macos", AGENT, also=RUST_SDK + PROXY_RUNTIME, pr_paths=(), runner=MACOS,
-         run="python3 scripts/test_git_metadata.py && cargo build --workspace --all-targets --locked"
-             " && ./scripts/macos-debug-app.sh && cargo test --workspace --locked",
-         cache="agent-full-macos", timeout=45, gate=False, **AGENT_FLAKE),
+    Lane("agent-full-macos", AGENT, also=RUST_SDK + PROXY_RUNTIME + APPLE_TOOLCHAIN, pr_paths=(),
+         run="python3 scripts/test_git_metadata.py"
+             f" && cargo build --workspace --all-targets --locked {RUNTIME_SHADERS}"
+             f" && ./scripts/macos-debug-app.sh && cargo test --workspace --locked {RUNTIME_SHADERS}",
+         cache="agent-full-macos", timeout=45, gate=False, **AGENT_MACOS),
     # The native Windows suite: nightly (which saves its cache) and by label, on the free runner.
     Lane("agent-full-windows", AGENT, also=RUST_SDK + PROXY_RUNTIME, pr_paths=(), labels=("ci:windows", "ci:full"),
          events=PR_AND_NIGHTLY,
@@ -267,7 +281,12 @@ def deny(manifest: str, component: str) -> str:
          events=PR_AND_NIGHTLY, job="agent-package-linux", run="just package-rehearsal", timeout=60, gate=False, **AGENT_PACKAGE_FLAKE),
     Lane("agent-package-macos", AGENT_PACKAGING + APPLE_TOOLCHAIN, pr_paths=(), labels=("ci:package", "ci:full"),
          events=PR_AND_NIGHTLY, job="agent-package-macos", runner=MACOS, run="just package-rehearsal", timeout=60,
-         gate=False, **AGENT_PACKAGE_FLAKE),
+         gate=False, requires=("metal-toolchain",), **AGENT_PACKAGE_FLAKE),
+    # Exports Xcode's Metal Toolchain as a one-day artifact for the macOS packaging rehearsal,
+    # which compiles gpui's shaders like the signed builds. Nothing selects it by path or
+    # label: the planner adds it to every plan with a lane that requires it.
+    Lane("metal-toolchain", (), pr_paths=(), labels=(), gate=False, job="metal-toolchain",
+         runner=GITHUB_XCODE, timeout=15),
     Lane("agent-package-windows", AGENT_WINDOWS_PACKAGING, pr_paths=(), labels=("ci:package", "ci:full"),
          events=PR_AND_NIGHTLY, job="agent-package-windows", runner=GITHUB_WINDOWS, workdir="apps/maple-agent", run=WINDOWS_PACKAGE,
          env=(("RUSTFLAGS", "-D warnings -C target-feature=+crt-static"),) + FAST_RELEASE, timeout=90, gate=False),
diff --git a/scripts/ci/plan.py b/scripts/ci/plan.py
index fdc7b6499..bb4bf86be 100644
--- a/scripts/ci/plan.py
+++ b/scripts/ci/plan.py
@@ -87,6 +87,19 @@ def everything(event: str, why: str) -> Selection:
     return {lane.id: [why] for lane in active(event)}
 
 
+def with_requirements(selected: Selection) -> Selection:
+    """Add every lane a selected lane requires, transitively: the requiring lane's job needs theirs."""
+    by_id = {lane.id: lane for lane in LANES}
+    pending = list(selected)
+    while pending:
+        lane = by_id.get(pending.pop())
+        for name in lane.requires if lane else ():
+            if name not in selected:
+                pending.append(name)
+            selected.setdefault(name, []).append(f"required by {lane.id}")
+    return selected
+
+
 def select(event: str, paths: Iterable[str], labels: Sequence[str] = ()) -> Selection:
     """Active lanes that the changed paths and PR labels select for `event`."""
     lanes = active(event)
@@ -115,7 +128,7 @@ def select(event: str, paths: Iterable[str], labels: Sequence[str] = ()) -> Sele
                 chosen.setdefault(lane.id, []).append(f"label {label}")
     if approvals:  # opensecret-eif.yml compares the edited approvals instead
         chosen.pop("os-eif", None)
-    return chosen
+    return with_requirements(chosen)
 
 
 def hook_components(paths: Iterable[str]) -> List[str]:
@@ -170,7 +183,7 @@ def plan_event(event: str, payload: dict) -> Selection:
         unknown = sorted(set(names) - {lane.id for lane in active(event)})
         if unknown:
             raise ValueError(f"not an active lane: {', '.join(unknown)}")
-        return {name: ["dispatch"] for name in names}
+        return with_requirements({name: ["dispatch"] for name in names})
     if event == NIGHTLY:
         return everything(event, "nightly")
     labels: List[str] = []
@@ -496,6 +509,33 @@ def lint_problems(files: Sequence[str]) -> List[str]:
             problems.append(f"ci.yml plan: {variable} is not passed to plan.py")
     if f"toolchain: {AGENT_WINDOWS_RUST}\n" not in WINDOWS_SETUP.read_text():
         problems.append(f"setup-agent-windows does not pin Rust {AGENT_WINDOWS_RUST}")
+    # A lane's requirements run only for it: they exist, form no cycle, select nothing on their
+    # own, and the requiring lane's special job waits for theirs.
+    by_id = {lane.id: lane for lane in LANES}
+    for lane in LANES:
+        for name in lane.requires:
+            required = by_id.get(name)
+            if required is None:
+                problems.append(f"{lane.id}: requires unknown lane {name}")
+                continue
+            if required.paths or required.pr_paths or required.labels or required.gate:
+                problems.append(f"{name}: a required lane must have no paths, labels or gate")
+            if lane.job in MATRIX_JOBS or lane.job not in blocks:
+                problems.append(f"{lane.id}: a lane with requirements needs its own ci.yml job")
+                continue
+            needs = re.search(r"^    needs: \[?([^\]\n]*)\]?$", blocks[lane.job], re.M)
+            if not needs or required.job not in {n.strip() for n in needs[1].split(",")}:
+                problems.append(f"ci.yml {lane.job}: needs does not include {required.job}")
+    for lane in LANES:
+        seen, stack = set(), list(lane.requires)
+        while stack:
+            name = stack.pop()
+            if name == lane.id:
+                problems.append(f"{lane.id}: requirement cycle")
+                break
+            if name not in seen and name in by_id:
+                seen.add(name)
+                stack.extend(by_id[name].requires)
     declared = set(re.findall(r"^\s+- (\S+)$", (ROOT / ".github/actionlint.yaml").read_text(), re.M))
     problems += [f"{lane.id}: {lane.opensecret} is no opensecret_change_detection.py output" for lane in LANES
                  if lane.opensecret and lane.opensecret not in OPENSECRET_OUTPUTS + ("pcr",)]
diff --git a/scripts/ci/test_cargo_graph_key.py b/scripts/ci/test_cargo_graph_key.py
index 66a78464e..deb406152 100644
--- a/scripts/ci/test_cargo_graph_key.py
+++ b/scripts/ci/test_cargo_graph_key.py
@@ -199,6 +199,16 @@ def test_a_flake_lock_change_changes_the_key(self):
         flake["nodes"]["nixpkgs"]["locked"]["rev"] = "b" * 40
         self.assertNotEqual(key(flake=flake), key())
 
+    def test_toolchain_pins_join_the_key_only_when_given(self):
+        pin = '{\n  "version": "27.1",\n  "build": "27A9275"\n}\n'
+        lockfiles = (lock_text(PACKAGES), json.dumps(FLAKE, indent=2))
+        self.assertEqual(cargo_graph_key.key(*lockfiles, ()), key())
+        self.assertNotEqual(cargo_graph_key.key(*lockfiles, (pin,)), key())
+        self.assertNotEqual(cargo_graph_key.key(*lockfiles, (pin.replace("27A9275", "27A9276"),)),
+                            cargo_graph_key.key(*lockfiles, (pin,)))
+        self.assertEqual(cargo_graph_key.key(*lockfiles, (pin.replace("\n", "\r\n"),)),
+                         cargo_graph_key.key(*lockfiles, (pin,)))
+
     def test_formatting_order_and_line_endings_do_not_change_the_key(self):
         reordered = copy.deepcopy(PACKAGES[::-1])
         for package in reordered:
@@ -265,6 +275,15 @@ def test_prints_one_github_output_line_for_the_agent_lockfiles(self):
         self.assertEqual(code, 0)
         self.assertRegex(stdout, r"\Ahash=[0-9a-f]{64}\n\Z")
 
+    def test_a_pin_file_argument_changes_the_agent_key(self):
+        agent = ROOT / "apps/maple-agent"
+        lockfiles = (str(agent / "Cargo.lock"), str(agent / "flake.lock"))
+        _, plain, _ = self.run_main(*lockfiles)
+        code, pinned, _ = self.run_main(*lockfiles, str(ROOT / "scripts/ci/apple-toolchain.json"))
+        self.assertEqual(code, 0)
+        self.assertRegex(pinned, r"\Ahash=[0-9a-f]{64}\n\Z")
+        self.assertNotEqual(pinned, plain)
+
     def test_the_agent_lock_keeps_its_key_when_every_local_version_is_bumped(self):
         agent = ROOT / "apps/maple-agent"
         text, flake = (agent / "Cargo.lock").read_text(), (agent / "flake.lock").read_text()
diff --git a/scripts/ci/test_contracts.py b/scripts/ci/test_contracts.py
index 4251232b4..05819c8c8 100644
--- a/scripts/ci/test_contracts.py
+++ b/scripts/ci/test_contracts.py
@@ -417,8 +417,12 @@ def test_c4_ci_restores_only_what_a_master_workflow_saves(self):
                     if step["uses"].startswith("actions/cache/save@"):
                         self.assertIn("refs/heads/master' && github.event_name == 'schedule'", step["if"])
                     else:
-                        self.assertTrue(step["with"]["key"].startswith("ci-v1-agent-package-${{ runner.os }}-"))
-                        self.assertEqual(step["with"]["restore-keys"], "ci-v1-agent-package-${{ runner.os }}-")
+                        # macOS also leads with the Xcode pin, so a prefix restore never
+                        # brings back objects built against another SDK.
+                        prefix = "ci-v1-agent-package-${{ runner.os }}-" + (
+                            "${{ hashFiles('scripts/ci/apple-toolchain.json') }}-" if job_id == "agent-package-macos" else "")
+                        self.assertTrue(step["with"]["key"].startswith(prefix))
+                        self.assertEqual(step["with"]["restore-keys"], prefix)
             elif name == "ci.yml":
                 with self.subTest(job=job_id):
                     self.assertTrue(step["uses"].startswith("actions/cache/restore@"))
@@ -459,7 +463,12 @@ def test_c4_agent_release_key_hashes_the_dependency_graph_and_toolchain(self):
         # empty or misnamed output would turn the exact key into a prefix that restores any
         # entry of the family.
         agent = ROOT / "apps/maple-agent"
-        expected = cargo_graph_key.key((agent / "Cargo.lock").read_text(), (agent / "flake.lock").read_text())
+        lockfiles = ((agent / "Cargo.lock").read_text(), (agent / "flake.lock").read_text())
+        # The macOS builder also hashes the Xcode pin, so an Xcode upgrade never restores
+        # objects built against the previous SDK.
+        apple = ((ROOT / "scripts/ci/apple-toolchain.json").read_text(),)
+        expected = {job: cargo_graph_key.key(*lockfiles, apple if job == "macos-build" else ())
+                    for _, job in AGENT_RELEASE_WRITERS}
         pattern = r"ci-v1-agent-release-\$\{\{ runner\.os \}\}-\$\{\{ steps\.([\w-]+)\.outputs\.([\w-]+) \}\}"
         with tempfile.TemporaryDirectory() as temporary:
             working = Path(temporary) / "bin/python3"
@@ -497,7 +506,7 @@ def run(step, directory, python, output):
                     output = Path(temporary) / f"{job_id}.output"
                     result = run(step, directory, working, output)
                     self.assertEqual(result.returncode, 0, result.stderr)
-                    self.assertEqual(output.read_text().splitlines(), [f"{reference[2]}={expected}"])
+                    self.assertEqual(output.read_text().splitlines(), [f"{reference[2]}={expected[job_id]}"])
                     failed = Path(temporary) / f"{job_id}.failed"
                     self.assertNotEqual(run(step, directory, failing, failed).returncode, 0)
                     self.assertEqual(failed.read_text() if failed.exists() else "", "")
diff --git a/scripts/ci/test_plan.py b/scripts/ci/test_plan.py
index c78ab8a40..86ac44266 100644
--- a/scripts/ci/test_plan.py
+++ b/scripts/ci/test_plan.py
@@ -1,6 +1,7 @@
 """Lane selection: the table, the planner's events and the pre-commit hook."""
 
 import contextlib
+import dataclasses
 import io
 import json
 import os
@@ -233,6 +234,25 @@ def test_every_tracked_file_is_classified_and_ci_yml_matches(self):
                               plan.lint_problems(plan.tracked_files()))
 
 
+    def test_a_lane_with_requirements_waits_for_their_jobs(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            workflow = Path(tmp) / "ci.yml"
+            workflow.write_text(plan.CI_WORKFLOW.read_text().replace(
+                "    needs: [plan, metal-toolchain]\n    if: fromJSON(needs.plan.outputs.lanes)['agent-package-macos']",
+                "    needs: plan\n    if: fromJSON(needs.plan.outputs.lanes)['agent-package-macos']"))
+            with mock.patch.object(plan, "CI_WORKFLOW", workflow):
+                self.assertIn("ci.yml agent-package-macos: needs does not include metal-toolchain",
+                              plan.lint_problems(plan.tracked_files()))
+        def edited(lane_id, **changes):
+            return tuple(dataclasses.replace(lane, **changes) if lane.id == lane_id else lane for lane in lanes.LANES)
+        for broken, problem in ((edited("agent-package-macos", requires=("no-such-lane",)),
+                                 "agent-package-macos: requires unknown lane no-such-lane"),
+                                (edited("metal-toolchain", labels=("ci:full",)),
+                                 "metal-toolchain: a required lane must have no paths, labels or gate")):
+            with self.subTest(problem=problem), mock.patch.object(plan, "LANES", broken):
+                self.assertIn(problem, plan.lint_problems(plan.tracked_files()))
+
+
 class HookTests(unittest.TestCase):
     """The pre-commit hook's components: a path selects those of the lanes that own it."""
 
@@ -379,6 +399,21 @@ def test_packaging_rehearsals_run_only_by_label_and_nightly(self):
             self.assertEqual(agent_lanes(selected(["docs/x.md"], labels=[label])) & packages, packages)
         self.assertLessEqual(packages, active(NIGHTLY))
 
+    def test_a_required_lane_runs_only_with_the_lane_that_requires_it(self):
+        # The macOS packaging rehearsal compiles gpui's shaders on Blacksmith, whose image
+        # cannot download the Metal Toolchain; metal-toolchain exports it, and only that
+        # requirement ever selects it.
+        consumer, required = "agent-package-macos", "metal-toolchain"
+        for event in (PR, PUSH):
+            with self.subTest(event=event):
+                self.assertFalse({consumer, required} & selected(["apps/maple-agent/app/src/main.rs"], event))
+        for label in ("ci:package", "ci:full"):
+            with self.subTest(label=label):
+                chosen = plan.select(PR, ["docs/x.md"], [label])
+                self.assertIn(consumer, chosen)
+                self.assertEqual(chosen[required], [f"required by {consumer}"])
+        self.assertLessEqual({consumer, required}, active(NIGHTLY))
+
     def test_full_suites_run_on_master_nightly_and_by_label(self):
         full = {"agent-full-linux", "agent-full-macos", "agent-full-windows"}
         self.assertFalse(full & selected(["apps/maple-agent/app/src/main.rs"]))
@@ -564,6 +599,11 @@ def test_schedule_and_dispatch(self):
         self.assertEqual({lane for lane, on in outputs["lanes"].items() if on}, {"agent-test"})
         self.assertEqual([entry["id"] for entry in outputs["nix"]], ["agent-test"])
 
+    def test_dispatching_a_lane_also_runs_the_lanes_it_requires(self):
+        _, outputs = self.github(DISPATCH, {}, LANES_INPUT="agent-package-macos")
+        self.assertEqual({lane for lane, on in outputs["lanes"].items() if on},
+                         {"agent-package-macos", "metal-toolchain"})
+
     def test_quarantined_lanes_still_run_and_an_unknown_id_fails_the_plan(self):
         code, outputs = self.github(NIGHTLY, {}, CI_QUARANTINE=" research-ios,agent-test, ")
         self.assertEqual((code, outputs["quarantine"]), (0, ["agent-test", "research-ios"]))
@@ -622,6 +662,8 @@ def test_a_cache_key_pins_the_toolchain_and_leaves_lockfiles_to_rust_cache(self)
                 workspace = lane.workspaces.split("->")[0].strip()
                 pins = {f"{workspace}/{name}" for name in ("flake.lock", "rust-toolchain.toml")
                         if (plan.ROOT / workspace / name).is_file()}
+                if lane.runner == lanes.MACOS:  # and the Xcode that builds against the SDK
+                    pins.add("scripts/ci/apple-toolchain.json")
                 with self.subTest(lane=lane.id):
                     self.assertIn(f"{workspace}/flake.lock", pins)
                     self.assertEqual(set(lane.cache_files), pins)
diff --git a/scripts/ci/test_workflow_policy.py b/scripts/ci/test_workflow_policy.py
index a123a5edb..d38f33a2a 100644
--- a/scripts/ci/test_workflow_policy.py
+++ b/scripts/ci/test_workflow_policy.py
@@ -30,7 +30,9 @@
 PINNED = re.compile(r"[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+(?:/[A-Za-z0-9_./-]+)?@[0-9a-f]{40}")
 # Standard images, and the org's one GitHub-hosted larger runner, by its exact label:
 # a pattern would also admit a self-hosted runner that borrowed the name.
-GITHUB_HOSTED = re.compile(r"(?:ubuntu|macos|windows)-[A-Za-z0-9.-]+|maple-windows-2025-16core")
+# GitHub-hosted labels: the standard images, the per-Xcode macOS images (xcode-27) and the
+# org's larger Windows runner.
+GITHUB_HOSTED = re.compile(r"(?:ubuntu|macos|windows)-[A-Za-z0-9.-]+|xcode-[0-9]+|maple-windows-2025-16core")
 # The workflows that run on pull requests or the merge queue. Every other check is a
 # ci.yml lane (scripts/ci/lanes.py), so ci-ok judges it; adding one here is an owner call.
 PULL_REQUEST_WORKFLOWS = frozenset({

From 257b80df9d3f20a3a7f6ee0c28a3f5a93f4e7791 Mon Sep 17 00:00:00 2001
From: Anthony Ronning <101225832+AnthonyRonning@users.noreply.github.com>
Date: Thu, 29 Oct 2026 02:57:55 +0000
Subject: [PATCH 5/6] ci: build iOS for the Research app's iOS-only sources

The UIScene manifest (Info.ios.plist), the plugins' Swift sources and the
vendored tao's iOS platform layer only compile into the iOS app, yet no
path of research-ios covered them, so a change there ran no iOS build
unless someone added ci:ios.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 scripts/ci/lanes.py     | 4 ++++
 scripts/ci/test_plan.py | 5 +++++
 2 files changed, 9 insertions(+)

diff --git a/scripts/ci/lanes.py b/scripts/ci/lanes.py
index fd50e7bcc..1b7762442 100644
--- a/scripts/ci/lanes.py
+++ b/scripts/ci/lanes.py
@@ -343,6 +343,10 @@ def deny(manifest: str, component: str) -> str:
     # desktop-build.yml, mobile-build.yml and android-build.yml build master.
     Lane("research-ios", (TAURI + "gen/apple/**", TAURI + "icons/ios/**", TAURI + "capabilities/mobile-ios.json",
                           TAURI + "tauri.ios-dev.conf.json", TAURI + "Info.plist", TAURI + "Entitlements.plist",
+                          # iOS-only sources: the scene manifest tauri-cli merges into the app's
+                          # plist, plugin Swift code, and the vendored tao's iOS platform layer.
+                          TAURI + "Info.ios.plist", TAURI + "plugins/*/ios/**", TAURI + "patches/*/ios/**",
+                          TAURI + "patches/tao-*/src/platform_impl/ios/**",
                           TAURI + "scripts/*ios*", TAURI + "scripts/canonicalize-static-archive.py",
                           TAURI + "scripts/onnxruntime-pins.sh", "scripts/ci/ios-*.sh", "scripts/ci/ios-build-profile.py",
                           "scripts/ci/canonical-ios-app-hash.py", "scripts/ci/_common.sh",
diff --git a/scripts/ci/test_plan.py b/scripts/ci/test_plan.py
index 86ac44266..0d9748ca1 100644
--- a/scripts/ci/test_plan.py
+++ b/scripts/ci/test_plan.py
@@ -497,6 +497,11 @@ def test_research_platform_builds_run_on_native_inputs_or_labels(self):
         # Mobile builds still follow their native inputs; desktop bundles never block
         # a PR (desktop-build.yml builds master; ci:package rehearses them).
         for path, lanes_ in ((tauri + "gen/apple/project.yml", {"research-ios"}),
+                             (tauri + "Info.ios.plist", {"research-ios", "research-rust"}),
+                             (tauri + "plugins/tauri-plugin-iap/ios/Sources/IapPlugin.swift",
+                              {"research-ios", "research-rust"}),
+                             (tauri + "patches/tao-0.37.1/src/platform_impl/ios/app_state.rs",
+                              {"research-ios", "research-rust"}),
                              (tauri + "gen/android/app/build.gradle.kts", {"research-android"}),
                              (tauri + "dmg/background.tiff", {"research-rust"}),
                              (tauri + "tauri.conf.json", {"research-rust", "repo"}),

From 14c9407ffa5ef57fbd25ec26b3ca3b5435e3b8a6 Mon Sep 17 00:00:00 2001
From: Anthony Ronning <101225832+AnthonyRonning@users.noreply.github.com>
Date: Thu, 29 Oct 2026 03:28:02 +0000
Subject: [PATCH 6/6] ci: keep dev-profile proc-macros unstripped on macOS 27
 too

ci.yml sets CARGO_PROFILE_DEV_DEBUG=0, and Cargo strips build scripts
and proc-macros whenever their profile has no debug info, so dev builds
hit the same rust-objcopy alignment bug as release builds:
research-dev-macos (tauri build --debug, deployment target 13.4) failed
with "can't find crate for `zerofrom_derive`" on Xcode 27.1. Reproduced
locally with CI's settings; the dev build-override fixes it. The Agent
gets the same setting, because its dev lanes only pass today on rustc's
default deployment target.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/maple-agent/Cargo.toml                       | 14 +++++++++-----
 apps/maple-research/frontend/src-tauri/Cargo.toml | 12 ++++++++----
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/apps/maple-agent/Cargo.toml b/apps/maple-agent/Cargo.toml
index a5660ddaa..8432cc8bc 100644
--- a/apps/maple-agent/Cargo.toml
+++ b/apps/maple-agent/Cargo.toml
@@ -35,11 +35,15 @@ lto = "fat"
 codegen-units = 1
 strip = true
 
-# rustc strips with rust-objcopy, which can leave a dylib's LINKEDIT string table
-# 4-byte aligned. macOS 27 refuses to load such dylibs when they are linked against
-# its SDK, and the build loads its proc-macros as dylibs. Build scripts and
-# proc-macros never ship, so leave them unstripped. Remove once the pinned Rust's
-# rust-objcopy includes llvm/llvm-project#203680.
+# Cargo strips build scripts and proc-macros whenever their profile has no debug info
+# (release, and dev under CI's CARGO_PROFILE_DEV_DEBUG=0), using rustc's rust-objcopy,
+# which can leave a dylib's LINKEDIT string table 4-byte aligned. macOS 27 refuses to
+# load such dylibs when they are linked against its SDK, and every build loads its
+# proc-macros as dylibs. They never ship, so leave them unstripped. Remove once the
+# pinned Rust's rust-objcopy includes llvm/llvm-project#203680.
+[profile.dev.build-override]
+strip = false
+
 [profile.release.build-override]
 strip = false
 
diff --git a/apps/maple-research/frontend/src-tauri/Cargo.toml b/apps/maple-research/frontend/src-tauri/Cargo.toml
index be10e613b..4ced1b877 100644
--- a/apps/maple-research/frontend/src-tauri/Cargo.toml
+++ b/apps/maple-research/frontend/src-tauri/Cargo.toml
@@ -119,10 +119,14 @@ tao = { path = "patches/tao-0.37.1" }
 # vendored copy only adds that keyword. Remove once upstream publishes the fix.
 tauri-plugin-sign-in-with-apple = { path = "patches/tauri-plugin-sign-in-with-apple-1.0.2" }
 
-# Release builds strip with rustc's rust-objcopy, which can leave a dylib's LINKEDIT
-# string table 4-byte aligned. macOS 27 refuses to load such dylibs when they are
-# linked against its SDK, and the build loads its proc-macros as dylibs. Build
-# scripts and proc-macros never ship, so leave them unstripped. Remove once the
+# Cargo strips build scripts and proc-macros whenever their profile has no debug info
+# (release, and dev under CI's CARGO_PROFILE_DEV_DEBUG=0), using rustc's rust-objcopy,
+# which can leave a dylib's LINKEDIT string table 4-byte aligned. macOS 27 refuses to
+# load such dylibs when they are linked against its SDK, and every build loads its
+# proc-macros as dylibs. They never ship, so leave them unstripped. Remove once the
 # pinned Rust's rust-objcopy includes llvm/llvm-project#203680.
+[profile.dev.build-override]
+strip = false
+
 [profile.release.build-override]
 strip = false