[GH-ISSUE #69] Create a resettable macOS clean-room environment #57

New issue

Open

opened 2026-10-15 18:20:35 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:20:35 +00:00

Owner

Originally created by @morluto on GitHub (Jul 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/69

Problem

TCC, Keychain ACLs, signing, quarantine, application location, prior launches, and updater state make workstation observations irreproducible.

Outcome

Define and automate a resettable macOS VM environment with versioned snapshots, isolated identities, tool manifests, and verified rollback.

Requirements

Supported OS/architecture matrix; base/test snapshots; non-personal user; TCC/Keychain reset; disposable signing; mounted-image/Downloads/Applications locations; REA/Hopper/LLDB/Electron/proxy tools; offline/loopback/controlled-proxy modes; environment evidence; contamination checks.

Safety

No personal Apple ID, credentials, Keychain, or host-home mounts. Secrets are ephemeral and outside snapshots. Do not redistribute licensed software or weaken host security.

Acceptance criteria

Equivalent restores yield equivalent manifests; declared permission/keychain/quarantine states reproduce; rollback removes credentials/files/processes; evidence records image/snapshot/tool identities; setup and recovery are documented.

Dependencies

Parent #27. Requires environment manifests and process ownership.

Verification

Snapshot restoration, contamination, TCC, Keychain, quarantine/location, signing, network policy, host isolation, and secret non-persistence tests.

Non-goals

Shipping licensed VM images, personal accounts, security-prompt bypass, or universal physical-Mac parity.

Originally created by @morluto on GitHub (Jul 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/69 ## Problem TCC, Keychain ACLs, signing, quarantine, application location, prior launches, and updater state make workstation observations irreproducible. ## Outcome Define and automate a resettable macOS VM environment with versioned snapshots, isolated identities, tool manifests, and verified rollback. ## Requirements Supported OS/architecture matrix; base/test snapshots; non-personal user; TCC/Keychain reset; disposable signing; mounted-image/Downloads/Applications locations; REA/Hopper/LLDB/Electron/proxy tools; offline/loopback/controlled-proxy modes; environment evidence; contamination checks. ## Safety No personal Apple ID, credentials, Keychain, or host-home mounts. Secrets are ephemeral and outside snapshots. Do not redistribute licensed software or weaken host security. ## Acceptance criteria Equivalent restores yield equivalent manifests; declared permission/keychain/quarantine states reproduce; rollback removes credentials/files/processes; evidence records image/snapshot/tool identities; setup and recovery are documented. ## Dependencies Parent #27. Requires environment manifests and process ownership. ## Verification Snapshot restoration, contamination, TCC, Keychain, quarantine/location, signing, network policy, host isolation, and secret non-persistence tests. ## Non-goals Shipping licensed VM images, personal accounts, security-prompt bypass, or universal physical-Mac parity.

bsakaguchi added the

labels

2026-10-15 18:20:35 +00:00

bsakaguchi commented

2026-10-15 18:20:36 +00:00

Author

Owner

@morluto commented on GitHub (Jul 20, 2026):

Split into focused child issues:

#381
#382

These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

@morluto commented on GitHub (Jul 20, 2026): Split into focused child issues: - [ ] #381 - [ ] #382 These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

bsakaguchi referenced this issue

2026-10-15 18:22:04 +00:00

[GH-ISSUE #330] Add reactive scenario algebra for process capture #176

bsakaguchi referenced this issue

2026-10-15 18:22:06 +00:00

[GH-ISSUE #331] Build reactive process-capture end-to-end fixture #180

bsakaguchi referenced this issue

2026-10-15 18:25:35 +00:00

[GH-ISSUE #1464] [Bug] Terminal line restoration guide ignores normalization and Unicode widths #496

bsakaguchi added

enhancement

and removed