[kshitijk4poor]

Summary

Salvage of #95605 (@zengzheqing) onto current main with a hardening follow-up: the dylib-complete re-land of the macOS TCC interpreter anchor, live-verified on real macOS hardware (Apple Silicon), plus fixes for three review findings around alias-failure observability and concurrency.

The contributor's three commits are cherry-picked with authorship preserved and apply cleanly (zero conflicts — no churn on these files since the PR branched).

What the anchor does (from #95605)

Re-land of the mechanism reverted in #95563, against that revert's criteria (dylib-complete design, live-verified on macOS hardware):

1. venv/bin/python is a real-file copy of the uv-store interpreter, identifier-DR signed (com.nousresearch.hermes.managed-python) — TCC grants survive Python patch bumps ([Bug]: macOS permission prompts return after every update — TCC grants keyed to the uv-managed Python interpreter path, not the app bundle #85345).
2. python3 / python3.N are real-file copies, never symlinks — symlink aliases lose the venv prefix on python-build-standalone builds ([Bug]: macOS TCC anchor re-points venv python3 aliases to symlinks that cannot find the stdlib — CLI dies with ModuleNotFoundError: encodings #95541).
3. Store libpython* is hardlinked into venv/lib/ so @executable_path/../lib resolves — no more dyld death ([Bug]: macOS TCC anchor copies the uv interpreter into venv/bin without libpython — every hermes command dies in dyld #95425).
4. Pre-install boot gate: the staged copy is actually launched (import encodings + sys.prefix == <venv>, scrubbed env) before os.replace. A bad anchor can never brick update/doctor again.
5. hermes doctor reports/installs the anchor; hermes update refreshes it. The revert-era heal (check_macos_tcc_anchor_removed) is removed — first-generation broken copies are repaired in place.

Follow-up hardening (our commit, review findings on the salvage)

• _copy_alias no longer swallows OSError silently — it warns and reports failure (a leftover alias symlink is the exact [Bug]: macOS TCC anchor re-points venv python3 aliases to symlinks that cannot find the stdlib — CLI dies with ModuleNotFoundError: encodings #95541 crash shape; previously invisible).
• Alias staging uses mkstemp unique names so concurrent ensures (update + doctor --fix) can never promote a truncated interim copy.
• The anchor marker is written last and atomically (write-then-rename): it now asserts the whole layout (anchor + aliases) is complete. A partially-materialized alias set can no longer read "active" in doctor — the next ensure retries instead.
• The /.hermes-runtime/python/ store marker is derived from managed_uv._RUNTIME_DIR_NAME instead of a drift-prone hardcoded string.
• 5 new regression tests covering each behavior.

Validation (live on macOS arm64)

Check	Result
pytest test_macos_tcc_anchor.py test_doctor.py	104 passed (39 anchor incl. real-interpreter macos_only E2E)
Fresh anchor, dynamic cpython-3.12 uv store	python/python3/python3.12 boot, venv prefix, libpython hardlinked (same inode)
Fresh anchor, static cpython-3.11.15 managed-runtime (the #95541 interpreter class)	3/3 entry points boot, signed identifier pinned
Reproduced first-gen brick (dyld Library not loaded @executable_path/../lib/libpython)	repaired in place by ensure_tcc_anchor; all entry points boot after
Idempotency	second ensure leaves bin/python byte-identical
Forced boot-gate refusal	live venv untouched, zero staging leftovers, next ensure recovers
Forced alias failure (new path)	anchor left unmarked, doctor won't report active, retry completes
pip + console scripts in anchored venv	work
Store deleted mid-patch-bump	interpreter still boots (hardlink survives)
ruff check + git diff --check	clean

Field confirmation of the alias-copy approach: #95551 comment from @fred0m (production install, #95541 signature, recovered with the same mechanism). Reviewer findings from @kokhlo on #95605 (gate env scrub, EACCES refusal, marker realpath) were already addressed by the contributor with regression tests.

Credit

Anchor design and implementation by @zengzheqing (#95605) — commits cherry-picked with authorship preserved. Builds on @kokhlo's review (#95754 closed as duplicate) and the failure-mode mapping in #95358 / #95476 / #95551.

Closes #95596. Closes #95605. Refs #85345, #95425, #95541, #95563.

Post-review fold (/simplify-code on the final stack)

• refactor(macos): _write_marker now uses the shared utils.atomic_write_text (repo's single atomic-text-write implementation, adds fsync + cross-device fallbacks) instead of a bespoke mkstemp/replace block.
• Final-stack mutation check: reverting macos_tcc_anchor.py to the contributor base fails the 3 new-behavior guards and passes the sync-contract test (correct split); full suite 39/39 green after restore.
• Reviewed non-findings: _RUNTIME_DIR_NAME private import is the right coupling (no public bare-name accessor; sync test binds it); +13ms lazy-import cost on hermes doctor only — not material.

[zengzheqing]

Verified the hardening commit (e447609) — all four changes are sound. Making alias failures visible is right (a leftover symlink is exactly the #95541 crash shape); the atomic marker-last write closes the torn-read/partial-layout window; mkstemp staging removes the concurrent-ensure collision; deriving the store marker from _RUNTIME_DIR_NAME kills the drift risk. Thanks for the salvage — happy to see this land.