Remote Xcode signing

1. Contract and transport

1. RECORD remote SSH alias/account, repository revision/path, full Xcode path/version, project or workspace, shared scheme, configuration, app/extensions, Team ID, bundle IDs, distribution method, and manual/automatic signing policy.
2. USE the same non-root account for keychain provisioning, SSH build, and any Xcode/MCP session. Use trusted SSH host keys and noninteractive authentication; no agent forwarding or host-key-check bypass by default.
3. SELECT direct xcodebuild for reproducible archive/export. MCP is optional agent orchestration, not a signing prerequisite or credential manager.
4. READ references/source-evidence.md when reconciling the supplied guides, trust errors, or claims about headless MCP.
5. REQUIRE explicit authorization before importing private keys, changing certificate trust/search lists, enabling MCP permissions, registering devices, or contacting Apple's provisioning service. Keep publishing/upload outside this workflow.

Gate: one authorized host/account, build tuple, signing/distribution contract, and mutation scope.

2. Preflight in the actual SSH session

READ references/archive-export.md. Pin DEVELOPER_DIR per process instead of changing a shared Mac's global Xcode selection.