Provision signed engine and supervisor through installer #462

Objective

Provision the individually signed Codex Lab engine and its launchd supervisor through the supported install/update path instead of requiring manual canary setup.

Finish Line

A fresh supported install leaves the app, shim, immutable managed engine, and dev.everycode.codex-lab.app-server.v1 LaunchAgent healthy and mutually provenance-matched; update and rollback preserve a launchable prior state.

Current Status

• Complete on July 24, 2026 via merged PR Provision signed engine through Codex Lab installer #470 at ed5b78cb553219e9f33cfe12fb51915b4703fdf3.
• The schema-v2 release contract now includes codex-lab-engine-aarch64-apple-darwin.zip plus the engine binary digest, source commit, version, stable identifier com.shinycomputers.codex-lab.engine, TeamIdentifier MM5YXC7T6E, and required com.apple.security.cs.allow-jit entitlement.
• Exact-head release dry-run 30118793306 completed successfully. The self-hosted macOS runner built the release CLI, unlocked its signing keychain, applied Developer ID hardened-runtime signing with the JIT entitlement, re-inspected the signed archive, and validated the complete release set.
• The downloaded signed engine SHA-256 was 94be1671ae1b43d5f18f731820f198ed93dc09055d31d4f1dfae5fb19b3879eb.
• An isolated real launchd canary proved fresh install, healthy supervisor startup, forced update/restart with a new PID, uninstall, and restoration of the pre-installer managed engine without touching the existing production Lab service.
• Installer unit coverage now includes fresh install, update, no-shim layout, unsigned-engine rejection, supervisor failure rollback, rollback failure reporting, unmanaged-target refusal, uninstall rollback, and prior-engine restoration. Post-merge main CI run 30121254810 passed all five jobs.
• Supported release installation no longer requires manual canary engine or LaunchAgent provisioning. Remaining desktop architecture work continues in parent Prove persistent Codex Lab engine behind official Mac and iOS clients #385 and its other focused children.

Acceptance Criteria

• Release artifacts include or securely reference an individually signed managed engine with stable identifier and TeamIdentifier.
• Fresh install atomically installs the managed engine before enabling the launcher.
• Install/update invokes the supervisor installer with expected SHA-256, source commit, and version from verified release metadata.
• Failed engine or supervisor provisioning rolls back the app, shim, engine, LaunchAgent, and install state coherently.
• Update replaces the engine and restarts the service without enabling the upstream standalone updater.
• Uninstall/rollback removes only Codex Lab launchd state and restores the prior managed engine when present.
• Tests cover fresh install, update, no-shim install, provisioning failure, rollback failure reporting, and unsigned-engine rejection.
• Documentation no longer requires manual canary provisioning for a supported release install.

Relationships

• Sub-issue of Prove persistent Codex Lab engine behind official Mac and iOS clients #385.
• Follow-up to Add pinned launchd supervisor for Codex Lab daemon #459 and PR Supervise the pinned websocket app-server with launchd #461.
• Blocks treating the published release installer as a complete desktop installation path.

Validation

1. Installer unit tests with injected engine/supervisor operations and rollback assertions.
2. Signed macOS artifact build proving stable codesign identity.
3. Fresh-install and update canaries in an isolated Lab home and LaunchAgents directory.
4. Real user LaunchAgent install, crash recovery, update, uninstall, and rollback canaries.