Merge pull request #77 from TrentBrown/tb-portreeve-apple-trust-05-notarization-submit-recovery

Preserve Apple notarization request recovery

Author: TrentBrown

.github/workflows/release.yml

@@ -216,6 +216,14 @@ jobs:
           bun run release:produce-apple-trust -- --record
           "$RELEASE_ROOT/release-record.json" --qualification
           "$RELEASE_ROOT/evidence/trust-qualification.json" --output "$TRUSTED_ROOT"
+      - name: Preserve failed notarization recovery evidence
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: trusted-recovery-${{ inputs.version }}-${{ github.run_attempt }}
+          path: ${{ env.TRUSTED_ROOT }}/recovery
+          if-no-files-found: warn
+          retention-days: 7
       - uses: actions/upload-artifact@v7
         with:
           name: trusted-${{ inputs.version }}

docs/issues/tb-portreeve-apple-trust/decisions.md

@@ -59,3 +59,22 @@ When the protected producer transforms either macOS CLI, it must rewrite the cor
 Defer metadata repair until finalization - rejected because native verification must consume a self-consistent protected output. Keep separate unsigned and signed manifests - rejected because multiple authorities would make downstream selection ambiguous. Rebuild metadata independently in each native job - rejected because read-only verifiers must not mutate the producer output.
 
 **Promoted:** 2026-08-29. PR: https://github.com/TrentBrown/portreeve/pull/76.
+
+---
+
+## Persist notarization continuity at the producer boundary
+
+**Confidence:** HIGH
+
+**Blast Radius:** Protected Apple producer, failure artifacts, exact signed DMG retention, workflow uploads, and notarization evidence
+
+Treat successful notarytool submit output as request creation even when status is absent, while keeping info responses strict. Drive the real producer through the existing finite recovery state machine, persist every non-secret state transition beside the exact signed DMG before and after Apple calls, and upload only that recovery directory when the protected job fails. Once a request ID exists, all continuation targets that ID; no new submission is allowed. Successful candidates retain the recovery history but move the authoritative DMG into the normal trusted artifact set.
+
+**Triggered by:** Live run 33267482516 returned a valid Apple request ID without status, then the producer rejected the response and deleted its output
+
+**Alternatives considered:**
+- Add `notarytool --wait` - rejected because it bypasses the approved explicit polling and continuity model.
+- Default missing status without recording the request lifecycle - rejected because a later failure would again erase continuity.
+- Keep deleting output on failure - rejected because exact signed bytes and failed-attempt evidence would disappear.
+
+**Promoted:** 2026-08-29. PR: https://github.com/TrentBrown/portreeve/pull/77.

docs/issues/tb-portreeve-apple-trust/events.jsonl

@@ -64,7 +64,7 @@ unconditional cleanup.
 
 ## I-5 - Produce and aggregate native trust evidence
 
-- **Status:** in-review
+- **Status:** closed
 - **Estimate:** 2d
 - **Plan steps:** P5
 - **Rubric criteria:** R3, R5, R7
@@ -77,7 +77,7 @@ aggregation require one current document for each native architecture.
 
 ## I-6 - Seal finalization and publication boundaries
 
-- **Status:** in-review
+- **Status:** closed
 - **Estimate:** 2d
 - **Plan steps:** P6
 - **Rubric criteria:** R1, R2, R6, R7
@@ -90,7 +90,7 @@ recovery and disjoint Apple/publication authority.
 
 ## I-7 - Complete operator documentation and regression suites
 
-- **Status:** in-review
+- **Status:** closed
 - **Estimate:** 1d
 - **Plan steps:** P7
 - **Rubric criteria:** R1, R3, R4, R5, R6, R7
@@ -103,7 +103,7 @@ the focused and broad verification matrices.
 
 ## I-8 - Run protected rehearsal and complete verification
 
-- **Status:** open
+- **Status:** in-progress
 - **Estimate:** 1d
 - **Plan steps:** P8
 - **Rubric criteria:** R1, R2, R3, R4, R5, R6, R7, R8
@@ -114,3 +114,20 @@ From reviewed code pinned on `main`, produce and inspect the complete trusted
 preview packet with both native authorities and publication disabled. Preserve
 zero-public-mutation evidence; route defects through fresh sequential slices
 before full feature evaluation and close-out.
+
+## I-9 - Correct asynchronous notarization submission recovery
+
+- **Status:** in-review
+- **Estimate:** 1d
+- **Plan steps:** P2, P8
+- **Rubric criteria:** R4, R7, R8
+- **Depends on:** I-2, I-4, I-8
+- **PR:** [#77](https://github.com/TrentBrown/portreeve/pull/77)
+
+Correct the protected producer defect observed in hosted run
+`33267482516`: asynchronous `notarytool submit` returned a valid request ID
+without a status, but the producer required status before beginning its poll
+loop. Integrate the existing bounded recovery state machine into the real
+producer, preserve exact signed candidates and non-secret request history on
+failure, add failure-only workflow upload, and prove one-submit request
+continuity with producer-level tests before another protected attempt.

docs/issues/tb-portreeve-apple-trust/issues.md

@@ -0,0 +1,34 @@
+{
+  "schemaVersion": 1,
+  "scope": "slice",
+  "featureId": "tb-portreeve-apple-trust",
+  "repositoryAlias": "portreeve",
+  "packetId": "pr-77",
+  "pullRequest": {
+    "repository": "TrentBrown/portreeve",
+    "number": 77,
+    "url": "https://github.com/TrentBrown/portreeve/pull/77",
+    "state": "OPEN",
+    "isDraft": true,
+    "baseRefName": "main",
+    "baseRefOid": "4f4610f27639a09ba53692757971ea0ce7af7061",
+    "headRefName": "tb-portreeve-apple-trust-05-notarization-submit-recovery",
+    "headRefOid": "048bee8901d13780a47ef19237c1bdf06ab4e3ed"
+  },
+  "mergeBaseSha": "4f4610f27639a09ba53692757971ea0ce7af7061",
+  "evaluatedSourceSha": "048bee8901d13780a47ef19237c1bdf06ab4e3ed",
+  "featureBaseSha": null,
+  "applicability": {
+    "specEvaluation": true,
+    "judge": true,
+    "patternReview": true
+  },
+  "gates": {
+    "verification": {"disposition": "passed", "reason": null},
+    "specEvaluation": {"disposition": "passed", "reason": null},
+    "judge": {"disposition": "passed", "reason": null},
+    "codeReview": {"disposition": "passed", "reason": null},
+    "patternReview": {"disposition": "passed", "reason": null},
+    "explainDiff": {"disposition": "passed", "reason": null}
+  }
+}

docs/issues/tb-portreeve-apple-trust/pr-77/boundary.json

@@ -0,0 +1,38 @@
+# Code Review - PR #77
+
+**Pinned diff:** `4f4610f27639a09ba53692757971ea0ce7af7061..048bee8901d13780a47ef19237c1bdf06ab4e3ed`
+
+**Verdict:** PASS
+
+## Findings
+
+No actionable findings remain at the corrected pinned source.
+
+The first boundary review found that the producer submitted a recovery copy
+and then stapled that same file in place. A later failure could therefore
+retain post-staple bytes that no longer matched the pre-staple SHA-256 bound to
+Apple's request. GateReeve entered remediation before review was requested.
+Commit `048bee8901d13780a47ef19237c1bdf06ab4e3ed` preserves the submitted copy
+unchanged and performs stapling, Gatekeeper assessment, mounted verification,
+and final artifact staging on a distinct working copy. The added regression
+test mutates the working copy and proves the submitted SHA-256 is unchanged.
+
+## Review Evidence
+
+- Submit output parsing accepts a valid UUID without inventing a status;
+  strict `info` parsing supplies the status authority.
+- Recovery state is persisted atomically before and after Apple calls and is
+  bound to release ID plus candidate SHA-256.
+- A known request is polled and never resubmitted; nonzero submit results still
+  preserve any valid machine-readable UUID before failing.
+- Failure-only upload contains only the recovery directory, uses a bounded
+  retention period, and excludes keychain/P12/P8/password material.
+- The trusted producer still has no publication authority, and the correction
+  does not change installer architecture, channels, or public state.
+
+## Residual Risks and Test Gaps
+
+- The corrected path has not yet called Apple's live service or produced the
+  two current native evidence documents; that is the next feature-final slice.
+- The failure artifact path is validated by producer and workflow contract
+  tests; its hosted retention must be observed if the protected rerun fails.