Ship the Homebrew native runtime intact past keg relocation

[danielwinterw]

The bug

Every published Homebrew install ships a native runtime the host rejects. On a clean brew install Mesh-LLM/tap/mesh-llm (v0.75.1, Apple Silicon):

$ mesh-llm runtime list
warning: skipping malformed native runtime /opt/homebrew/Cellar/mesh-llm/0.75.1/libexec/native-runtimes/meshllm-native-runtime-darwin-aarch64-metal: native runtime file checksum mismatch for lib/libggml-base.0.17.0.dylib: expected fc2a8da1..., got 8461d9fa...
📦 No local native runtimes found

The formula installed native-runtimes/ directly into libexec. Homebrew then relocates the keg: it rewrites install names and re-signs every Mach-O file it finds. All 24 runtime libraries change — the keg copies carry flags=0x2(adhoc) where the shipped ones are 0x20002(adhoc,linker-signed). manifest.json records a SHA-256 for every runtime file, and the loader refuses a runtime whose files no longer match, so the Metal runtime is discarded and the CLI has no local runtime.

The fix

Stage the runtime as an archive during install and unpack it in post_install_steps, after relocation has run. The runtime needs none of that relocation: its libraries link only against system libraries and resolve each other through @loader_path. This keeps the shipped bytes — and the manifest's integrity guarantee — intact.

Why CI did not catch it

runtime list exits 0 and prints a warning naming the runtime it rejected, so assert_match "native runtime" matched the failure text just as happily as a success. The test now asserts on the discovered runtime id and on the absence of the rejection warning, and tests/homebrew-release.test.ts pins both that and the archive/post-install shape so this cannot regress.

Verification

Against the published v0.75.1 Apple Silicon archive, on macOS 26.2 (arm64), using this repo's own CI sequence:

• brew style — clean
• brew audit --strict mesh-llm/packaging-validation/mesh-llm — clean
• brew install --formula mesh-llm/packaging-validation/mesh-llm — ok
• brew test mesh-llm/packaging-validation/mesh-llm — passes, including the existing client-readiness smoke
• mesh-llm runtime list now reports ✅ meshllm-native-runtime-darwin-aarch64-metal 0.75.1 (metal)

node --experimental-strip-types --test tests/*.test.ts: 92 pass, 2 fail. Both failures are pre-existing on main in tests/workflow-provenance.test.ts and unrelated to this change — they shell out to mapfile, which macOS's bash 3.2 does not provide.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ea2074ec-6aab-44f1-896a-02abd5e09acb

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}