Add reusable Apple build with explicit native provenance

[RCmerci]

Journal Apple builds currently reconstruct target, dependency, cache and signing checks across local scripts. The existing entry point also silently falls back to a stub and ignores signing failures. This change makes that entry point explicit and repeatable, with one shared Swift/package/icon/sign pipeline. AGENTS keeps a short entry link; detailed guidance lives in .agents/skills/journal-build/SKILL.md.

• Select macOS, arm64 Simulator or arm64 iPhoneOS SDK/target explicitly. Native macOS requires a matching prepared switch; stub linking and experimental host-object restamping require explicit modes. No dependency updates, pin changes, cache clearing or app installation occur during build.
• Read active switch pins directly, retaining installed-source conflict checks and binding CI local pins, their URL refs and clean checkouts to fixed lock commits. Rehash the recorded GMP archive and its actual linked copy at final acceptance.
• Preserve existing probe --native-object callers through isolated --probe-native-object; absent objects explicitly select link-only. Probe target/runtime/hash checks and distinct staged bundles carry no production provenance/ABI claim.
• Bind caches and manifests to source/configuration, dependency/native ABI inputs, toolchain/SDK, flags and target. Add external phase logs, cache/switch occupancy checks, cancellation cleanup, output preservation and artifact provenance.
• For the existing experimental iOS route, validate the fixed complete object against producer source/configuration/pins and original hash-bound evidence. A prior successful build receipt distinguishes consumed historical archives from current build inputs, so later authorized cache rebuilds do not invalidate an unchanged complete object. Current object/runtime headers/evidence/SDK and target checks stay strict; native changes require new producer evidence.
• Compile DNS/crypto C for the selected target, verify final link-map providers and runtime/mldoc/XMLm retention, check every Swift object platform, package device icons/resources before signing, and verify profile/certificate/team/entitlements and the final signature. Legacy Dune/probe raw-object injection now fails with a migration message; protected Dune/spec/lock files are unchanged.

Validation

• 24 build-boundary tests pass on Python 3.9 and 3.13, including changed/deleted historical archives, later builder-only commits, tampered object/source/C/header/evidence/receipt, live process locks and actual Simulator-vs-device SDK/Mach-O rejection.

• Real icon compilation passes for macOS, Simulator and device.

• Final script completed an actual iPhoneOS production package (1.0 / 1.5877.30): reused the immutable OCaml complete object, freshly compiled target C and Swift/LUI in a new cache namespace (Swift 25.65s), verified 55 iPhoneOS ARM64 Swift objects, mldoc/XMLm retention, icons/resources, signature/entitlements and input stability, from clean final head 293c05cc5a43b63e5bfbadd57a2414639cadfcb1. No phone installation or launch.

• Actual warm-start Swift source completed a full Simulator probe compile/link, icon packaging and strict adhoc signature verification at clean tested head 7a85f7d (Swift 25.85s; the later native-macOS GMP-only guard does not change the probe helper/source), using a caller-supplied target object. No installation, launch or runtime/ABI acceptance.

• Two Simulator link-only runs previously demonstrated cache reuse (Swift 24.92s to 0.55s, identical executable bytes). These are link/packaging checks only.

• Independent exact-head review reproduced an early cache-lock release when a cancelled command leader exits before a SIGTERM-ignoring child. Fixed by terminating the remaining process group before unlock; the final review also caught untracked LUI Swift files bypassing the pin guard, which now rejects them before native import; the real fork/FIFO regression failed before and passes after. Independent pre-build journal-code-review passed; Final independent exact-head review confirmed the cancellation fix and the LUI untracked-source fix, with no remaining evidenced finding. Current decision and diff checks pass; the global decision check reports three unchanged historical documents with missing sections.

• All four original GitHub review threads now contain specific fixes/evidence and are resolved. Independent exact-head reviews confirmed the additional local-pin ref/fixed-lock repair and final 293c05c GMP-copy guard; 24 tests pass on both Python versions. Final-head Journal CI completed successfully: icons, locked dependencies, all/native targets, full regression suite and logs passed.

Limits

The explicitly selected host ARM64 OCaml/runtime restamp remains experimental compatibility, not a verified full iOS OCaml cross toolchain or ABI/runtime acceptance. This production packaging run did not recompile OCaml from scratch. Native macOS validation remains blocked locally by the pre-existing switch's missing mldoc, nonlocked XMLm and incomplete cached Git objects; build does not repair that environment implicitly.

A real macOS warm-start probe attempt passes the new object/CLI checks but stops at unchanged baseline swift/JournalChrome.swift:378 (listSectionSpacing is unavailable in macOS). This separate product limitation was not changed by this Build PR.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T03:11:11.242490Z	ee00a2a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ee00a2aa07

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".