CTO UX, sync hardening, iOS companion, CI signing, simplification pass

.ade/cto/identity.yaml

@@ -1,13 +1,6 @@
 name: CTO
-version: 2
-persona: >-
-  You are the CTO for this project inside ADE.
-
-  You are the persistent technical lead who owns architecture, execution
-  quality, engineering continuity, and team direction.
-
-  Use ADE's tools and project context to help the team move forward with clear,
-  concrete decisions.
+version: 3
+persona: Persistent project CTO with strategic personality.
 personality: strategic
 modelPreferences:
   provider: claude
@@ -30,5 +23,6 @@ openclawContextPolicy:
     - system_prompt
 onboardingState:
   completedSteps:
-    - integrations
-updatedAt: 2026-03-16T04:16:18.954Z
+    - identity
+  completedAt: 2026-03-17T20:35:20.336Z
+updatedAt: 2026-03-17T20:35:20.336Z

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/apps/desktop"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+  - package-ecosystem: "npm"
+    directory: "/apps/mcp-server"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -32,15 +32,27 @@ jobs:
       - name: Install web dependencies
         run: cd apps/web && npm ci
 
-      - name: Typecheck
+      - name: Typecheck desktop
         run: cd apps/desktop && npm run typecheck
 
+      - name: Typecheck MCP server
+        run: cd apps/mcp-server && npm run typecheck
+
+      - name: Lint desktop
+        run: cd apps/desktop && npm run lint
+
       - name: Test desktop
         run: cd apps/desktop && npm test
 
       - name: Test MCP server
         run: cd apps/mcp-server && npm test
 
+      - name: Build desktop
+        run: cd apps/desktop && npm run build
+
+      - name: Build MCP server
+        run: cd apps/mcp-server && npm run build
+
       - name: Build web
         run: cd apps/web && npm run build
 

.github/workflows/release.yml

@@ -21,8 +21,58 @@ jobs:
           git fetch origin main --depth=1
           git merge-base --is-ancestor "$GITHUB_SHA" origin/main
 
-  release:
+  build-mac-app:
     needs: verify
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: arm64
+            runner: macos-latest
+            app_dir: mac-arm64
+          - arch: x64
+            runner: macos-15-intel
+            app_dir: mac
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: apps/desktop/package-lock.json
+
+      - name: Install desktop dependencies
+        run: cd apps/desktop && npm ci
+
+      - name: Stamp release version
+        env:
+          ADE_RELEASE_TAG: ${{ github.ref_name }}
+        run: cd apps/desktop && npm run version:release
+
+      - name: Build unsigned macOS app bundle
+        run: cd apps/desktop && npm run dist:mac:dir -- --${{ matrix.arch }}
+
+      - name: Archive app bundle
+        run: |
+          APP_PATH="apps/desktop/release/${{ matrix.app_dir }}/ADE.app"
+          ARCHIVE_PATH="apps/desktop/release/ADE-${{ matrix.arch }}.app.zip"
+          test -d "$APP_PATH"
+          ditto -c -k --sequesterRsrc --keepParent "$APP_PATH" "$ARCHIVE_PATH"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: mac-app-${{ matrix.arch }}
+          path: apps/desktop/release/ADE-${{ matrix.arch }}.app.zip
+          if-no-files-found: error
+
+  release:
+    needs:
+      - verify
+      - build-mac-app
     runs-on: macos-latest
     concurrency:
       group: release-${{ github.ref_name }}
@@ -36,21 +86,51 @@ jobs:
         with:
           node-version: 22
           cache: npm
-          cache-dependency-path: |
-            apps/desktop/package-lock.json
-            apps/mcp-server/package-lock.json
+          cache-dependency-path: apps/desktop/package-lock.json
 
       - name: Install desktop dependencies
         run: cd apps/desktop && npm ci
 
-      - name: Install MCP server dependencies
-        run: cd apps/mcp-server && npm ci
-
       - name: Stamp release version
         env:
           ADE_RELEASE_TAG: ${{ github.ref_name }}
         run: cd apps/desktop && npm run version:release
 
+      - uses: actions/download-artifact@v4
+        with:
+          name: mac-app-arm64
+          path: apps/desktop/release/_ci/downloads/arm64
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: mac-app-x64
+          path: apps/desktop/release/_ci/downloads/x64
+
+      - name: Expand architecture app bundles
+        run: |
+          rm -rf apps/desktop/release/_ci/arm64 apps/desktop/release/_ci/x64
+          mkdir -p apps/desktop/release/_ci/arm64 apps/desktop/release/_ci/x64
+          ditto -x -k apps/desktop/release/_ci/downloads/arm64/ADE-arm64.app.zip apps/desktop/release/_ci/arm64
+          ditto -x -k apps/desktop/release/_ci/downloads/x64/ADE-x64.app.zip apps/desktop/release/_ci/x64
+
+      - name: Merge universal app bundle
+        run: cd apps/desktop && npm run merge:mac:universal
+
+      - name: Materialize App Store Connect API key
+        env:
+          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+        run: |
+          if [ -z "$APPLE_API_KEY_P8" ] || [ -z "$APPLE_API_KEY_ID" ]; then
+            echo "::error::Missing APPLE_API_KEY_P8 or APPLE_API_KEY_ID GitHub secret."
+            exit 1
+          fi
+
+          KEY_PATH="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY_ID}.p8"
+          printf '%s' "$APPLE_API_KEY_P8" > "$KEY_PATH"
+          chmod 600 "$KEY_PATH"
+          echo "APPLE_API_KEY=$KEY_PATH" >> "$GITHUB_ENV"
+
       - name: Create draft GitHub release with generated notes
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -64,4 +144,8 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           ELECTRON_CACHE: ${{ runner.temp }}/electron
           ELECTRON_BUILDER_CACHE: ${{ runner.temp }}/electron-builder
-        run: cd apps/desktop && npm run release:mac
+          CSC_LINK: ${{ secrets.CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+        run: cd apps/desktop && npm run release:mac:universal

.gitignore

@@ -51,3 +51,4 @@ xcuserdata/
 .pnpm-store/
 /apps/desktop/.ade
 /.playwright-mcp
+/.codex-derived-data

CONTRIBUTING.md

@@ -17,6 +17,62 @@ npm run dev
 - TypeScript strict mode is enabled
 - Tests use Vitest
 
+## Signed macOS releases
+
+For ADE's current release path, the correct Apple objects are:
+
+- `Developer ID Application` certificate for signing the `.app`
+- App Store Connect `Team Key` for notarization
+
+You do not need these for the current ADE flow:
+
+- `Developer ID Installer` certificate, because ADE ships `dmg` + `zip`, not `pkg`
+- A provisioning profile, unless the app later adds Apple advanced capabilities that require a Developer ID provisioning profile
+
+The tagged macOS release workflow expects these GitHub Actions secrets:
+
+- `CSC_LINK` — Developer ID Application certificate (`.p12`), typically base64-encoded
+- `CSC_KEY_PASSWORD` — password for the Developer ID Application certificate
+- `APPLE_API_KEY_P8` — raw contents of the App Store Connect Team API key (`AuthKey_*.p8`)
+- `APPLE_API_KEY_ID` — App Store Connect key ID
+- `APPLE_API_ISSUER` — App Store Connect issuer ID
+
+The release workflow builds ADE in three stages:
+
+1. `arm64` app bundle on `macos-latest`
+2. `x64` app bundle on `macos-15-intel`
+3. universal app merge, then signing, notarization, `dmg`/`zip` packaging, and GitHub release publish from the merged app
+
+Current Apple setup flow:
+
+1. On a Mac, create a CSR in Keychain Access using `Certificate Assistant > Request a Certificate from a Certificate Authority`, and save it to disk.
+2. In Apple Developer > Certificates, Identifiers & Profiles > Certificates, click `+`.
+3. Under `Software`, choose `Developer ID`, then choose `Developer ID Application`.
+4. Upload the CSR, download the `.cer`, and double-click it so it appears in Keychain Access under `login > My Certificates`.
+5. Export that certificate from Keychain Access as a `.p12` file with a password. This is the certificate material used by `CSC_LINK`.
+6. In App Store Connect > Users and Access > Integrations > Team Keys, generate a Team API key and download the `.p8` file. Note the key ID and issuer ID.
+
+To test a signed macOS build locally, export the matching environment variables expected by `electron-builder` and run:
+
+```bash
+cd apps/desktop
+export CSC_LINK=/absolute/path/to/DeveloperIDApplication.p12
+export CSC_KEY_PASSWORD=...
+export APPLE_API_KEY=/absolute/path/to/AuthKey_XXXXXXXXXX.p8
+export APPLE_API_KEY_ID=XXXXXXXXXX
+export APPLE_API_ISSUER=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+npm run dist:mac:signed
+```
+
+To test the unsigned intermediate app bundle that the CI workflow produces per architecture, run:
+
+```bash
+cd apps/desktop
+npm run dist:mac:dir -- --arm64
+```
+
+The tagged release workflow should be run from a tag that points at `main`. Push the release tag only after the intended `main` commit is in place.
+
 ## Code Style
 
 - TypeScript with strict mode

README.md

@@ -63,28 +63,18 @@ ADE is built for people who want agents to operate inside a real development wor
 
 1. Download the latest `.dmg` from [**Releases**](https://github.com/arul28/ADE/releases)
 2. Open the `.dmg` and drag **ADE** into your Applications folder
-3. Move **ADE** into your Applications folder before trying to launch it
-4. Clear macOS quarantine for the installed app bundle:
-
-```bash
-xattr -dr com.apple.quarantine /Applications/ADE.app
-```
-
-5. Launch ADE, open a project, and configure your AI provider in Settings
+3. Launch ADE from Applications
+4. Open a project and configure your AI provider in Settings
 
 ## Early beta notes
 
 ADE is still a very early beta. Expect rough edges, incomplete workflows, and occasional breaking changes between releases.
 
-The macOS app is not code signed or notarized yet, so Gatekeeper may block it on first launch. Install the app by dragging it into `Applications` first, then if macOS still refuses to open it, run:
-
-```bash
-xattr -dr com.apple.quarantine /Applications/ADE.app
-```
+Official macOS releases are intended to ship as Developer ID-signed and notarized builds so Gatekeeper accepts them normally and ADE can apply future in-app updates without the quarantine workaround.
 
-That removes the quarantine attribute Apple adds to downloaded apps and allows ADE to launch locally. Only do this for builds you downloaded from the ADE releases page and trust.
+Older pre-signing beta builds may still need the manual `xattr -dr com.apple.quarantine /Applications/ADE.app` step if you are testing an older release artifact.
 
-ADE auto-updates. When a new version is available, an update button appears in the header bar -- click it to restart and apply.
+ADE auto-updates. When a new version is available, an update button appears in the header bar. Click it to restart and apply the signed update.
 
 ## Contributing
 

apps/desktop/build/entitlements.mac.inherit.plist

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+    <key>com.apple.security.inherit</key>
+    <true/>
+  </dict>
+</plist>

apps/desktop/build/entitlements.mac.plist

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+  </dict>
+</plist>