From 07af1cf7d59a78c24d26159647af78e7cb895cc7 Mon Sep 17 00:00:00 2001
From: EMRG Evolution <emrg@argszero.dev>
Date: Tue, 25 Aug 2026 14:51:02 +0800
Subject: [PATCH] emrg: guard against plist XML comments breaking codesign

---
 Agent.md                     |  2 +-
 tests/test_installer_stop.py | 24 ++++++++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/Agent.md b/Agent.md
index 0653d270..9cc5e903 100644
--- a/Agent.md
+++ b/Agent.md
@@ -118,7 +118,7 @@ Community needs voiced in HN agent-UI discussions map directly to EMRG's design:
 pkill -f "emrg.server"; rm -f ~/.emrg/emrgd.token; python -m emrg
 ```
 
-Python: `uv run pytest tests/ -v` (1061) — import check: `uv run python -c "from emrg.client.app import run_client"`
+Python: `uv run pytest tests/ -v` (1062) — import check: `uv run python -c "from emrg.client.app import run_client"`
 GUI: `cd emrg/gui && npm test` (259: 45 daemon_client + 20 conn-manager + 22 app-commands + 129 renderer smoke + 15 i18n + 8 integration + 3 commands + 8 build-config + 7 gui-state + 2 tool-group) — syntax: `node --check main.js preload.js daemon_client.js renderer/js/*.js`
 CI: `uv run pytest` (ubuntu + **windows-2025 matrix** — Windows pytest 回归在 PR CI 即失败，v0.2.29 教训 #725) + GUI tests + **actionlint workflow lint** (`rhysd/actionlint@v1.7.12` gate, #444 — workflow 解析错误在 PR CI 即失败，如 `if:` secrets 上下文)
 Re-trigger: `scripts/re-trigger-ci.sh [branch]` (workflow_dispatch, #527 — 替代空 commit 重触发：Actions outage 会整段丢弃 push 事件，dispatch 走 API 路径不受影响)
diff --git a/tests/test_installer_stop.py b/tests/test_installer_stop.py
index 0a0cdf6b..ccda95f5 100644
--- a/tests/test_installer_stop.py
+++ b/tests/test_installer_stop.py
@@ -468,3 +468,27 @@ def test_classify_locked_files_mixed():
         "bin/data.dat",
         "lib/websockets/speedups.cp313-win_amd64.pyd",
     ]
+
+
+def test_python_entitlements_plist_stays_comment_free():
+    """PR #975（2026-08-25）回归守卫：v0.2.78 macOS 公证构建失败根因之一 =
+    python-entitlements.plist 里 8 行 XML 注释导致 codesign AMFI 报错，修复 =
+    删注释。plist 是合法 XML，注释极易被后人重新写回（"解释下这权限干嘛的"）
+    → 本测试在任意平台 CI 先拦住，不用等 macOS 打包：
+
+      1. plist 不得含 XML 注释（<!-- ... -->）；
+      2. disable-library-validation 权限必须保留（与 make-installer.sh 签名后
+         fail-loud 检查同一不变式）；
+      3. 该权限的来龙去脉（rant 2026-08-25 journal R2：scipy ILP 实测阻断、
+         pip C 扩展 Team ID 不符加载失败）只许写在 make-installer.sh 注释里，
+         不得迁回 plist —— 两处断言互相锚定。
+    """
+    plist = _read("packaging/assets/python-entitlements.plist")
+    assert "<!--" not in plist
+    assert "<key>com.apple.security.cs.disable-library-validation</key>" in plist
+    assert "<true/>" in plist
+
+    script = _read("packaging/make-installer.sh")
+    # 上下文锚在签名循环注释（line ~66-71）+ fail-loud 检查（line ~78-84）
+    assert "journal R2" in script and "scipy" in script
+    assert "missing disable-library-validation entitlement" in script