The release-signing document says tagged builds are notarized by Apple, while missing secrets fall back to an ad-hoc signature.

macOS ties Keychain access and privacy grants, including screen recording, to the app's signing identity. A Developer ID signature stays the same across builds, while an ad-hoc signature changes with every build and forces a fresh Keychain prompt on each update.

v0.1.3 proves the old builds were ad-hoc, not that the current build is Developer ID or notarized. The stable-signing limit is not met by that measurement.

One-time setup requires the Apple Developer Program Account Holder role, and only that role can create Developer ID certificates. The buyer is constrained by repeated permission prompts and by a document that does not name the current release.

No page names the current release version, binary size, latency, battery impact, token usage, model list, provider retention policy, local chat history, price, or install count. The Key ID and Issuer ID are stored as GitHub secrets, and the signing secrets never pass through a chat or a file in the repo.

The release-signing document proves the signing path, not that the current release is notarized or that the app leaves no provider-side record.

The signing identity is the confirmed variable; the current release remains unnamed.