fix(ios): scope TestFlight notification identity verification

[azooz2003-bit]

Changelog

Fixed

Problem

The official com.cmux.app archive and export succeeded, but the TestFlight upload stopped in the post-sign verification because it applied NotificationService's application-identifier check to CloudVPN.appex. CloudVPN is a system-network extension with a different entitlement contract.

Fix

Keep strict code-signature verification for the notification service extension, but scope its notification identity check to NotificationService.appex and leave CloudVPN to its own signature contract.

Validation

• bash -n ios/scripts/upload-testflight.sh
• python3 -m unittest ios.tests.test_testflight_prepare_only
• node --test ios/tests/tagged-device-entitlements.test.mjs
• Previous run archive/export success and verifier failure: https://github.com/manaflow-ai/cmux/actions/runs/36930035410

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Fixes TestFlight uploads failing at post-sign verification by scoping the notification identity check to NotificationService.appex only.

Previously the verifier applied the notification service's application-identifier/team check to every .appex, including CloudVPN.appex, which is a system-network extension with a different entitlement contract. Now only NotificationService.appex is identity-checked, CloudVPN.appex is left to its own signature contract, and a missing NotificationService.appex fails the upload.

^{Written for commit a153d77. Summary will update on new commits.}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: c68e6d66-3057-4eed-a63f-1c6c8dc031be

📥 Commits

Reviewing files that changed from the base of the PR and between 12be747 and a153d77.

📒 Files selected for processing (1)

• ios/scripts/upload-testflight.sh

 _____________________________________________________________
< 🥕 I brought carrots. You brought corner cases. Let's party. >
 -------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Merge receipt for a153d77ded, merged 2026-10-01 21:50:46 UTC

• Not verified at merge: ci-status (not reported), CI fast guards (in progress), guards (5) (in progress), Web complexity (in progress)
• Verified: detect-ios-changes, Fast static checks, runner, web-validation
• Skipped by policy: browser, Claude wrapper regressions, Dogfood build #​${{ github.event.pull_request.number }}, full-suite-coverage, GhosttyKit release check, macos, remote-daemon, suite-coverage, web, web-build, web-database-tests, web-tests
• Full suite: runs on main after merge.

Labeled merged-unverified: if main breaks near this merge, look here first.