From 1d6102ad4a76efee2777516ff36c4dd0f7469c70 Mon Sep 17 00:00:00 2001
From: EMRG Evolution <emrg@argszero.dev>
Date: Thu, 6 Aug 2026 12:36:10 +0800
Subject: [PATCH] =?UTF-8?q?emrg:=20pkg=20=E5=85=AC=E8=AF=81=E7=BB=88?=
 =?UTF-8?q?=E9=AA=8C=E8=A1=A5=20spctl=20=E2=80=94=20Gatekeeper=20=E6=8E=A5?=
 =?UTF-8?q?=E5=8F=97=E7=A1=AE=E8=AE=A4=EF=BC=88rant=20=E9=AA=8C=E6=94=B6?=
 =?UTF-8?q?=20+=20=E8=AE=BE=E8=AE=A1=E6=96=87=E6=A1=A3=20=C2=A75.1?=
 =?UTF-8?q?=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/build-release.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 32895ea..dc5dc3d 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -180,6 +180,9 @@ jobs:
           if [ -z "$PKG" ]; then echo "no pkg found, skipping"; exit 0; fi
           xcrun stapler staple "$PKG"
           xcrun stapler validate "$PKG"
+          # P3 终验（rant 验收 + 设计文档 §5.1）：spctl -a 确认 Gatekeeper 接受
+          # （签名 + 公证 + staple 全链路的最终裁决；期望输出 "accepted"）
+          spctl -a -vv "$PKG"
 
       # ── 冒烟（§12，临时 HOME + 无 Python runner）────────────
       - name: Smoke test (R42 temp HOME)