feat(macos): build the agent binary for x86_64-apple-darwin (VA-88) #130

Merged

longjacksonle merged 2 commits from feat/VA-88-macos-x86_64-build into main

2026-07-14 03:32:28 +02:00

longjacksonle commented

2026-07-14 03:21:23 +02:00

Owner

VA-88 build-first: produce a native macOS x86_64-apple-darwin build of the agent. Scope is a clean compile + link + run; age-signing and the Forgejo registry publish are deferred, and Gatekeeper notarization (VA-128) and Mac runtime validation (VA-129) are separate follow-ups.

What changed

read_bundle is cfg-gated to any(target_os = "linux", target_os = "windows"). It feeds only the install/uninstall subcommands, which are already gated to those platforms, so on macOS it was dead code that tripped clippy --deny warnings. No behavior change on Linux/Windows.
New just build-macos recipe: a bare native cargo build --release --target x86_64-apple-darwin --bin vervain-agent (not containerised, since the Linux dev image cannot target darwin). Documents the Xcode CLT prerequisite, the id-16 target, default-features-only, and the out-of-scope surface.

Verified on an Intel Mac (macOS, Xcode CLT)

cargo check --bin vervain-agent: clean.
cargo clippy --bin vervain-agent -- -D warnings: clean.
cargo build --release --bin vervain-agent: links; produces the binary.
file reports Mach-O 64-bit executable x86_64; --version and --help run. The macOS command surface is run / config / signing-keygen / sign (no install/uninstall/assistance, as gated).

Also cross-checked every pure-Rust crate (kvm, protocol, config, mcp) for x86_64-apple-darwin on Linux, and confirmed the Linux build is unaffected (cargo check --bin vervain-agent clean natively).

Out of scope (tracked separately)

KVM/desktop (VA-7), macOS host_power parity (VA-17), macOS consent/GUI (VA-24). The macOS binary is a control-channel agent: enroll, secondary handshake, self-update receive, and the terminal/file/MCP tunnels; KVM reports NotAvailable.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QJiqE8CSatRaZysXtLHeVS

VA-88 build-first: produce a native macOS `x86_64-apple-darwin` build of the agent. Scope is a clean compile + link + run; age-signing and the Forgejo registry publish are deferred, and Gatekeeper notarization (VA-128) and Mac runtime validation (VA-129) are separate follow-ups. ## What changed - `read_bundle` is cfg-gated to `any(target_os = "linux", target_os = "windows")`. It feeds only the `install`/`uninstall` subcommands, which are already gated to those platforms, so on macOS it was dead code that tripped `clippy --deny warnings`. No behavior change on Linux/Windows. - New `just build-macos` recipe: a bare native `cargo build --release --target x86_64-apple-darwin --bin vervain-agent` (not containerised, since the Linux dev image cannot target darwin). Documents the Xcode CLT prerequisite, the id-16 target, default-features-only, and the out-of-scope surface. ## Verified on an Intel Mac (macOS, Xcode CLT) - `cargo check --bin vervain-agent`: clean. - `cargo clippy --bin vervain-agent -- -D warnings`: clean. - `cargo build --release --bin vervain-agent`: links; produces the binary. - `file` reports `Mach-O 64-bit executable x86_64`; `--version` and `--help` run. The macOS command surface is `run / config / signing-keygen / sign` (no `install`/`uninstall`/`assistance`, as gated). Also cross-checked every pure-Rust crate (`kvm`, `protocol`, `config`, `mcp`) for `x86_64-apple-darwin` on Linux, and confirmed the Linux build is unaffected (`cargo check --bin vervain-agent` clean natively). ## Out of scope (tracked separately) KVM/desktop (VA-7), macOS `host_power` parity (VA-17), macOS consent/GUI (VA-24). The macOS binary is a control-channel agent: enroll, secondary handshake, self-update receive, and the terminal/file/MCP tunnels; KVM reports `NotAvailable`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01QJiqE8CSatRaZysXtLHeVS

longjacksonle added 2 commits

2026-07-14 03:21:23 +02:00

feat(macos): compile the agent binary for x86_64-apple-darwin ff5fcb86c9

VA-88 build-first: the workspace already compiles for macOS (verified by cargo check on an Intel Mac and by cross-checking every pure-Rust crate for x86_64-apple-darwin on Linux). The one gap was a dead_code warning: read_bundle feeds only the install/uninstall subcommands, which are cfg-gated to Linux and Windows, so it is unused on macOS and trips the strict clippy --deny warnings gate. Gate the function to any(linux, windows) to match its callers.

KVM/desktop, service install, and per-OS power/consent parity stay out of scope (VA-7 / VA-17 / VA-24); the macOS build produces a control-channel agent (enroll, handshake, self-update receive, terminal/file/MCP tunnels) with KVM reporting NotAvailable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QJiqE8CSatRaZysXtLHeVS

chore(macos): add just build-macos native build recipe

Check / fmt + clippy + tests (pull_request) Successful in 5m36s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

8fc39bf7d8

Codify the VA-88 build-first command as a recipe. It is a bare `cargo build` (not a compose run) because the Linux dev image cannot target darwin, and it documents the target (x86_64-apple-darwin = AgentId 16), the Xcode CLT prerequisite, the default-features-only rule (no wayland-portal / agent-gui), and the out-of-scope surface (VA-7 / VA-17 / VA-24).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QJiqE8CSatRaZysXtLHeVS

longjacksonle scheduled this pull request to auto merge when all checks succeed

2026-07-14 03:32:24 +02:00