Production hardening

Phase 10 adds no features. It answers whether BitShout can be built, signed, installed, approved, upgraded, recovered, verified and distributed without weakening a single proven boundary.

Invariants the packaging must preserve

Invariant	Production meaning
Unknown ≠ allowed	Missing identity, state, entitlement, approval or health never becomes allow.
Unhealthy ≠ protected	The interface cannot claim protection when a required component is unhealthy.
Policy denial ≠ runtime enforcement	A deterministic denial is not OS enforcement until an entitled boundary proves it.
Credential ≠ capability	An approved capability never exports a reusable secret.
UI ≠ authority	The app presents intent and setup. The service and OS components own authority.
Path ≠ identity	Identity is signing, Team ID, bundle ID, version and hashes.
PID ≠ process identity	Phase 1 identity and lineage remain authoritative.
Heartbeat ≠ enforcement proof	Liveness is not correctness.
Evidence ≠ permission	The audit store records decisions; it never grants authority.
Guest ≠ host authority	Vault guest frames are assertions to validate.

Components and who owns what

BitShout.app is the SwiftUI application and setup centre — user intent and system-extension activation requests, and nothing else. The trusted service owns policy, sessions, grants, the capability broker, health, evidence, setup repair and migration. The Endpoint Security component owns filesystem and execution authorization callbacks once the entitlement and approvals exist. The Network Extension provider owns flow filtering through NEFilterDataProvider. The Vault Runtime Host is a signed process that owns the VZVirtualMachine lifecycle — deliberately not the GUI.

Passive launch

Normal GUI startup installs no privileged component, activates no system extension, retrieves no reusable credential, mutates no security state, starts no Vault VM, and requests no password. The requirement is written as a number that a test can check:

0 password prompts during passive launch

Setup, and what it may not do

First-run setup has a fixed order: install the trusted service, verify its identity and IPC, install the Endpoint Security extension and request macOS approval, install the Network Extension provider and request macOS approval, verify runtime state and health, install or verify Vault runtime assets, and recompute protection health. That order changes only through a documented architecture decision.

Setup may provision the app bundle, the trusted service, the system extension bundles, Vault runtime assets, BitShout-owned directories, and the permissions its own stores need. It may not bypass macOS consent. Running it again repairs rather than duplicates.

Setup required versus protection locked

Scenario	User-facing state	Security state
Required component never installed	Setup Required	No protection claim yet
Previously healthy component disappears	Protection Locked or Degraded	Runtime boundary failure
macOS approval waiting	Waiting Approval	Not protected for that boundary
Provider intentionally disabled	Setup Required or Disabled	Health stops claiming enforcement

The release gate

A release candidate does not pass because it compiles. The gate requires a deterministic release build from a clean checkout; separately signed app, trusted service, Endpoint Security extension, Network Extension provider and Vault Runtime Host; production entitlements extracted and compared; the Network Extension entitlement value content-filter-provider-systemextension verified on the extension bundle; no debug entitlements in production artifacts; Hardened Runtime enabled; a release manifest with component hashes; a Vault runtime manifest with hashes and helper protocol version; an installer built from the same commit; and a representative hostile regression run against the release artifacts.

Apple has approved the restricted Network Extension entitlement, along with the system-extension installation and virtualization entitlements. The Endpoint Security client entitlement is submitted and in review. Until it lands, BitShout does not claim production runtime filesystem or execution enforcement — see Trust.