Package Apple provider in macOS products

[i386]

Important

Experimental: you must have macOS Golden Gate (macOS 27) on Apple silicon to run this. This does not enable apple/system in published releases or advertise it to mesh peers.

Stack

• Builds on Add Apple provider host supervision #1252, which adds host-owned Apple provider supervision and versioned apple/system@27.0 routing.
• Tracks Proposal: add a macOS Core AI whole-model inference backend #1246.
• This is the Phase 2C1 CLI product-packaging and automatic-discovery layer. Swift, Node/Electron, and Kotlin/JVM distribution work remains in the next stack.

Why

The supervisor in #1252 can already drive Apple's on-device system model, but a user must point it at a development bundle manually. That is not a product: installers and unpacked releases need to carry one verified sidecar in a stable location, the host must find it without SDK-specific environment variables, and public artifacts must fail closed unless the executable has a real Developer ID signature and accepted Apple notarization.

For eligible Apple silicon users, this moves apple/system toward a zero-checkpoint-download, private, Apple-accelerated inference option that behaves like the same OpenAI-compatible MeshLLM model from every host-capable SDK. Foundation Models stays isolated in one Swift sidecar; the Rust host and SDKs do not link or reimplement Apple's API, and Skippy pipeline parallelism is not involved.

What changed

• Embeds the carrier-neutral Apple provider at provider-runtimes/apple/<runtime-id> beside the release host and native Metal runtime.
• Extends product-manifest.json with provider ID, version, kind, protocol, canonical path, complete tree SHA-256, and provider-manifest SHA-256.
• Validates the shared executable-provider contract again during product composition, including all declared payload hashes and the executable bit.
• Preserves provider-runtimes/ through the existing atomic Unix installer transaction.
• Uses the host's adjacent-product discovery so installed and unpacked products need neither MESH_LLM_PROVIDER_RUNTIME_BUNDLE_DIR nor MESH_LLM_PROVIDER_RUNTIME_INDEX.
• Adds an explicit local Golden Gate product lane for ad-hoc QA and keeps that exception visibly non-release-eligible.
• Adds a public lane that requires Developer ID Application signing, hardened runtime, a secure timestamp, an accepted notarytool submission, matching manifest/signature identity, and passing spctl assessment before product composition.
• Adds release-product QA that extracts the real tarball and repeats completion, streaming, tools, cancellation, process restart, route withdrawal, and shutdown checks from the packaged layout.
• Documents the composed product and the next SDK-carrier boundary.

There is no Apple backward-compatibility path here: the provider uses the mandatory protocol and version metadata introduced by #1252.

Requirements

You must have:

1. Apple silicon.
2. macOS Golden Gate (macOS 27).
3. Full Xcode 27 selected with xcode-select; Command Line Tools alone are insufficient.
4. Apple Intelligence enabled.
5. The system model downloaded and reported as available.

Confirm the environment:

xcode-select -p
xcodebuild -version
xcrun --sdk macosx --show-sdk-version
just apple::run status

The developer path should end in Xcode.app/Contents/Developer or the beta equivalent, the SDK should be 27.x, and status should report apple/system@27.0 as available.

Try the packaged product

From the repository root:

1. Build the release host, native Metal runtime, ad-hoc Apple provider, and composed tarball, then run the full product smoke:

   just apple::product-qa 0.72.1 target/apple-runtime/product

2. Inspect the retained result:

   jq . target/apple-runtime/product-qa/summary.json

   The important discovery evidence is:

   {
     "provider_discovery": "adjacent_product_bundle",
     "provider_bundle_override_used": false,
     "provider_index_override_used": false
   }

3. To run the composed product manually, extract it:

   mkdir -p target/apple-runtime/manual-product
   tar -xzf \
     target/apple-runtime/product/mesh-llm-0.72.1-aarch64-apple-darwin.tar.gz \
     -C target/apple-runtime/manual-product

4. Start the packaged host. The ad-hoc allowance is only for this local experimental artifact; there is deliberately no provider discovery override:

   MESH_LLM_APPLE_PROVIDER_ALLOW_AD_HOC=1 \
     ./target/apple-runtime/manual-product/mesh-bundle/mesh-llm \
       --log-format json serve \
       --port 9337 --console 3131 --headless

5. Send a completion over MeshLLM REST:

   curl -s http://127.0.0.1:9337/v1/chat/completions \
     -H 'content-type: application/json' \
     -d '{
       "model": "apple/system@27.0",
       "messages": [{
         "role": "user",
         "content": "Reply with exactly: apple runtime REST ready"
       }],
       "temperature": 0,
       "max_tokens": 32
     }' | jq

6. Exercise the deterministic tool path:

   curl -s http://127.0.0.1:9337/v1/chat/completions \
     -H 'content-type: application/json' \
     -d '{
       "model": "apple/system",
       "messages": [{"role":"user","content":"Use the tool with key: rest-demo"}],
       "tools": [{
         "type": "function",
         "function": {
           "name": "mesh_fixture_lookup",
           "description": "Look up a fixture",
           "parameters": {
             "type": "object",
             "properties": {"key": {"type": "string"}},
             "required": ["key"]
           }
         }
       }]
     }' | jq

Captured Golden Gate output

This output came from the extracted release product, not the direct Swift development server:

{
  "status": "pass",
  "model": "apple/system",
  "versioned_model": "apple/system@27.0",
  "provider_discovery": "adjacent_product_bundle",
  "provider_bundle_override_used": false,
  "completion_content": "apple runtime REST ready",
  "tool_executions": [{
    "name": "mesh_fixture_lookup",
    "arguments": {"key": "rest-demo"},
    "result": "mesh-fixture-value-for-rest-demo"
  }],
  "stream_done": true,
  "client_disconnect_cancelled": true,
  "provider_reported_in_management_api": true,
  "provider_restarted_after_crash": true,
  "provider_exited_with_meshllm": true
}

Public signing and notarization

A release operator first stores notarization credentials in Keychain using Apple's notarytool, then runs:

MESH_APPLE_RUNTIME_CODESIGN_IDENTITY="Developer ID Application: Example (TEAMID)" \
MESH_APPLE_RUNTIME_NOTARY_PROFILE=mesh-llm-notary \
  just apple::release-product \
    v0.72.1 0.1.0 \
    https://github.com/Mesh-LLM/mesh-llm/releases/download/v0.72.1/meshllm-apple-runtime-darwin-arm64.zip \
    dist

The exact provider ZIP is submitted with --wait; only Accepted proceeds. Composition then independently validates the provider contract, strict code signature, declared/actual team and signing identifiers, and spctl assessment. notarization.json records the submission result but never credentials.

This machine has only the local Mesh-LLM Local Codesign identity, so the public lane was correctly exercised as a fail-closed credential gate rather than falsely marked notarized. Producing the public artifact requires the release team's Developer ID Application certificate and notary profile.

Validation

• just apple::package
• just apple::product 0.72.1 target/apple-runtime/product
• just apple::product-smoke 0.72.1 target/apple-runtime/product-recheck
• extracted-product completion/SSE/tool/cancellation/restart/shutdown smoke — pass
• adjacent discovery with bundle/index overrides unset — pass
• just with-lld python3 -m unittest scripts.tests.test_package_release scripts.tests.test_install_sh — 34 passed
• just with-lld cargo fmt --all -- --check
• bash -n scripts/package-release.sh providers/apple/Packaging/package.sh providers/apple/QA/mesh.sh providers/apple/QA/product.sh
• shellcheck scripts/package-release.sh providers/apple/Packaging/package.sh providers/apple/QA/mesh.sh providers/apple/QA/product.sh
• git diff --check
• public release packaging without Developer ID identity — rejected as required

Next stack

Package this same signed artifact into every host-capable macOS SDK carrier: Rust bundle/resource discovery, Swift Bundle/XCFramework resources and sandbox lifecycle, Node/Electron optional platform package, and Kotlin/JVM resource extraction. All carriers should invoke the same host lifecycle and pass one protocol/product test suite; none should bind Foundation Models independently.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 78b1b01a-5350-44b5-a82f-8f56ccfed05e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

This pull request is currently a draft. Reviews will not take place until the PR is marked as ready for review.

[github-actions]

This pull request has not been updated in at least 5 days. It will be closed after 7 days of inactivity to keep the active review queue current. Please update it within 2 days if the changes are still moving forward.

[i386]

Collapsed into #1444, which rebases the whole Apple Core AI stack onto current main and folds in Nick's review (credential-scrubbing fix + Apple provider CI). Closing in favor of that single PR.