[AnthonyRonning]

Third layer of the CodeMode catch-up stack, on PR #1410 (the python tool). macOS apps now carry the CPython runtime the tool runs, so packaged builds offer python the way just run already does.

What changed

• Release packaging (scripts/macos-release-app.sh):
  • Prepares the hash-pinned runtime from scripts/python-runtime.json (Python Build Standalone 20260929, CPython 3.14.7) and copies it into Contents/Resources/python. The app's package resolver already looks there.
  • Signs every Mach-O in the runtime with the app's identity and timestamp, before the app seal. It uses master's macos_codesign, which retries Apple timestamp failures.
  • Signs the interpreter last, with its own entitlements (app/packaging/macos-python-entitlements.plist). Unsigned PR previews stay ad hoc without hardened runtime, like the app.
• One reviewed entitlement for the interpreter only: com.apple.security.cs.disable-library-validation. Hardened runtime would otherwise refuse native extensions of wheels the tool installs (numpy, lxml, …), whose code is signed by someone else or not at all. The app's own entitlements are unchanged. Sandboxing is out of scope for the tool, and the model already runs arbitrary programs through the shell, so this adds no capability the model lacks.
• Debug app: just debug-app bundles the runtime with ad hoc signatures and runs the worker smoke from inside the bundle. This is Port bundled CPython and ordered CodeMode into Maple Agent #897's macos-debug-app.sh change, applied unchanged apart from the version.
• CI: the pin, the preparation script and the notices are packaging inputs in lanes.py.

Rebased onto master's simplified release tooling. The verification-script and packaging-test additions an earlier revision carried went away with those files.

Size

The runtime adds 59 MB uncompressed to the app, once the next layer prunes Tcl/Tk and IDLE; it was 69 MB with them.

Validation

• just debug-app on macOS arm64: every runtime Mach-O signed; the bundle is "valid on disk" and "satisfies its Designated Requirement"; "CPython 3.14.7 (pbs-20260929-aarch64-apple-darwin) at …/Maple Agent Debug.app/Contents/Resources/python/bin/python3.14: native worker smoke passed".
• Before the rebase, the ci:package rehearsals passed on every platform: macOS, Linux, and Windows x64 and arm64. The Windows x64 run needed one rerun after an installer-check timeout. The label re-runs them on the rebased branch.
• Lint and all tests pass on the rebased stack.
• Not verifiable before merge: Developer ID signing and notarization with the nested interpreter. That happens in agent-desktop-build.yml on master.

Linux and Windows packaging follow in the next layers.

🤖 Generated with Claude Code