Apple Release Provenance

Prove the requested chain without collapsing distinct transformations:

source -> archive -> export -> published -> downloaded -> installed -> running

Invariants

Record exact source, dirty/generated inputs, dependencies, toolchain, CI/build identity, channel, and each artifact boundary. Filenames, versions, branches, valid signatures, or notarization alone do not prove a source revision.
Inspect effective signing, entitlements, profiles, nested code, and notarization at the stages where they are observable. Apple re-signs App Store products; submitted and delivered signatures or bundle bytes need not match.
Bind runtime evidence to the strongest observable build identity. On macOS, inspect the exact installed executable. Restricted platforms may expose only App Store Connect, app-reported, receipt, or diagnostic identifiers; mark inaccessible delivered-code claims unproven.
Treat TCC state as a separate runtime observation. Never transfer permission conclusions between builds or reset permissions just to simplify diagnosis.
Treat Sparkle archive, appcast, download, installed replacement, and relaunched executable as separate boundaries. Its signature proves neither source revision nor Apple signing state.