Regression-test permissions, daemon, and TCC behavior on macOS 27 betas

[malpern]

Post-1.0 tracking, but should happen during the macOS 27 beta cycle (public release expected September 2026). From the WWDC 2026 review — see docs/wwdc-2026-macos-27-opportunities.md (PR #911), §10.

Why

Nothing announced at WWDC26 changes SMAppService, XPC, or the TCC/Input Monitoring surface on paper — but TCC behavior shifts are historically where macOS major releases bite this app (PermissionOracle exists for exactly this reason).

Checklist (on each significant beta seed)

• PermissionOracle snapshots: IOHIDCheckAccess vs TCC DB precedence still correct (ADR-001, ADR-006)
• Accessibility + Input Monitoring grant/revoke flows and the installer wizard
• SMAppService daemon registration/approval flow (KanataDaemonService), including the Login Items UI changes in the new System Settings
• XPC helper code-signature validation still passes under the new SDK
• Sparkle update + notarization/Gatekeeper assessment on macOS 27 (Scripts/verify-installed-app.sh)
• Kanata daemon keyboard capture end-to-end (the macOS 27 design refresh touches system chrome; verify overlay windows render correctly)

https://claude.ai/code/session_01Nsiqm39oCwHkbrHytefnGM

[malpern]

macOS 27 beta checkpoint — 2026-07-11

Merged PR #1115 adds the repeatable strict capture and disposable-lab scenario. I then built and deployed a signed/notarized release candidate from merged master on macOS 27.0 build 26A5378j and ran the new harness with distribution trust enforcement enabled.

Automated evidence passed:

• release doctor and identity/signing contracts
• Apple notarization submission 8bea2f66-2959-4fcf-b28d-a8f034794697 accepted
• stapling and Gatekeeper (Notarized Developer ID)
• keypath-cli system inspect --json: planStatus=ready, driverCompatible=true, isOperational=true, userActionRequired=false
• VirtualHID extension [activated enabled]
• KeyPath-owned Kanata launchd job running
• KeyPath and Kanata processes present
• TCP readiness on 127.0.0.1:37001

Local evidence is preserved at ~/Library/Logs/KeyPath/macOS27-QA/26A5378j-20260712T003805Z and intentionally not uploaded because the bundle contains logs that should be inspected before sharing.

Still open for this beta seed: clean/disposable-account Accessibility and Input Monitoring grant/revoke behavior, Background App Activity/Login Items pending approval, Driver Extension UI navigation, live overlay visual behavior, and reboot persistence. Those remain operator-driven because bypassing or copying TCC state would invalidate the test.