diff --git a/bin/sign-launchd-agents b/bin/sign-launchd-agents
new file mode 120000
index 00000000..eaad6b3d
--- /dev/null
+++ b/bin/sign-launchd-agents
@@ -0,0 +1 @@
+../scripts/sign-launchd-agents.ts
\ No newline at end of file
diff --git a/docs/darwin-codesigning.md b/docs/darwin-codesigning.md
new file mode 100644
index 00000000..9133e11b
--- /dev/null
+++ b/docs/darwin-codesigning.md
@@ -0,0 +1,260 @@
+# Darwin codesigning — launchd agents, Login Items attribution, signing tooling
+
+**Verified against:** macOS 26.5.1 (build 25F80) on host `k` (aarch64-darwin);
+`rcodesign` 0.29.0 (dev-shell PATH via `modules/dev.nix`); Apple Developer
+Program individual membership with **Developer ID Application: Kris Williams
+(Y6VCVC728W)** in the login keychain. Worked example throughout: `nas-mount`
+(`modules/darwin/nas-mount.nix` + `pkgs/nas-mount/`), whose Login Items entry
+went from "nas-mount — Item from unidentified developer" to "NasMount" with a
+custom icon and real developer attribution. Checked 2026-07-09; automated
+activation-time signing added 2026-07-10 (see that section below).
+
+## The signing identity
+
+- **Cert types matter.** "Developer ID Application" is the distribution-grade
+  identity Gatekeeper/BTM attribution chains through. "Apple Development"
+  (Xcode's local-testing cert), "Apple Distribution", "Mac Developer ID
+  Installer" etc. are different animals — signing with an Apple Development
+  cert produces a *real, valid* signature (`TeamIdentifier` and all) that
+  still counts as unidentified, because it chains through Apple WWDR instead
+  of the Developer ID Certification Authority.
+- **Fresh web-portal certs are missing their intermediate.** A cert created
+  via developer.apple.com (rather than Xcode) imports without the
+  "Developer ID Certification Authority" intermediate, and every `codesign`
+  attempt fails `CSSMERR_TP_NOT_TRUSTED` (surfacing as a bare
+  `Permission denied`). Diagnose by matching the leaf's Authority Key
+  Identifier against the candidates' Subject Key Identifiers
+  (`openssl x509 -noout -text | grep -A1 'Key Identifier'`); Apple publishes
+  both generations at
+  [apple.com/certificateauthority](https://www.apple.com/certificateauthority/)
+  (`DeveloperIDCA.cer` = G1, `DeveloperIDG2CA.cer` = G2). Install with
+  `security add-certificates -k ~/Library/Keychains/login.keychain-db <cer>`;
+  `security verify-cert -p codeSign -c <leaf.pem>` confirms the chain.
+- **First use of the private key needs an interactive ACL grant** — macOS
+  pops "codesign wants to access key …"; click **Always Allow** (entering the
+  login password) or every future use prompts again. `security
+  set-key-partition-list -S apple-tool:,apple:,codesign: -s` is the CI-style
+  bulk equivalent, but unscoped it touches *every* signing-capable key in the
+  keychain — prefer the per-key GUI grant.
+
+## Two signing tools, two trust paths
+
+| | `codesign` (Apple) | `rcodesign` (apple-codesign, in dev shell) |
+|---|---|---|
+| Key source | Keychain (session ACL) | `.p12`/PEM file you supply |
+| Works from root/activation scripts | ❌ (see boundaries) | ✅ (no Keychain at all) |
+| Works in the nix build sandbox | ❌ | ✅ (keyless ad-hoc, or with key material) |
+| CI-viable | ❌ | ✅ technically — but by decision CI holds **no** signing key (see `knowledge/decisions/ci-github-actions.md`); the automated path runs at *activation* on the host instead |
+| Signs | anything ("signed generic" for non-code) | **Mach-O / bundle / DMG / pkg only** — errors `specified path is not of a recognized type` on scripts |
+
+This repo standardizes on **rcodesign** (decision:
+`knowledge/decisions/nas-mount-codesigning.md`) — the CI path is the point.
+Consequence: anything we want signed must be a real Mach-O or bundle, which
+is why `pkgs/nas-mount` is a compiled Rust binary, not a shell script.
+
+## Hard boundaries (all verified, don't re-attempt)
+
+- **Root cannot reach the login keychain's private keys. Period.** Not from
+  `system.activationScripts` via `sudo -u k`, not via `launchctl asuser <uid>`
+  to reattach the GUI session — the key material is walled off from root
+  even inside the right session. Only a process genuinely running as the
+  user in their real login session can use it. This is why OS `codesign`
+  can never be wired into `nrs` — the automated activation path (below)
+  works only because rcodesign signs from a key *file*, no keychain
+  involved.
+- **The nix build sandbox has no keychain either** — but keyless
+  `rcodesign sign` (ad-hoc) works fine there, which is load-bearing (below).
+- **`security export` cannot export a single identity** — `-t identities`
+  sweeps up *everything*, no per-item filter exists (documented CLI
+  limitation). With multiple identities in one `.p12`, `rcodesign` silently
+  picks one — it chose the wrong ("Apple Development") cert here despite its
+  docs claiming it errors on ambiguity. **Always export the one wanted
+  identity via Keychain Access.app** (My Certificates → right-click →
+  Export Items… → `.p12`; the `.p12` option is greyed out unless the item
+  includes its private key — use the My Certificates category, not
+  Certificates).
+- **The personal Keychain identity is never exported or committed.** The
+  original blanket "no key in sops" rejection was narrowed 2026-07-10: what
+  stays forbidden is exporting the Keychain-held Developer ID identity; a
+  **dedicated, purpose-minted cert whose key was born outside Keychain**
+  (openssl CSR → portal) IS sops-committed for the automated path below —
+  accepted-risk trade recorded in
+  `knowledge/decisions/nas-mount-codesigning.md` (2026-07-10 update).
+
+## Signing launchd agents: `sign-launchd-agents`
+
+`scripts/sign-launchd-agents.ts` (bun; on PATH in the dev shell via `bin/`)
+is the batch tool. It scans `~/Library/LaunchAgents`, resolves each plist's
+executable, and shows an fzf picker — status icon (✅ Developer ID /
+🍎 Apple-signed-no-team / 🔏 ad-hoc / ❌ unsigned / ❓ unresolved), Authority,
+Signed Time, live `codesign -dv` preview. Multi-select, then supply the path
+to your Keychain-Access-exported `.p12` + passphrase once for the whole
+batch. When an executable lives inside a `.app`, it signs the **bundle**
+(the code object Login Items attributes), not the bare inner Mach-O.
+Executables under `/nix/store/` are flagged read-only and skipped — they
+need a stable-path copy module first (`nas-mount.nix` is the template).
+
+Run it yourself, interactively — never through an agent session: the
+passphrase must not enter a transcript, and only your session could use the
+Keychain anyway. Delete the `.p12` when done.
+
+## Login Items attribution: the .app bundle recipe
+
+**A correct Developer ID signature on a bare launchd executable changes
+nothing** — BTM recorded `Developer Name: (null)` for a validly signed
+binary. Apple attributes launchd items through an **associated app bundle**
+([DTS answer](https://developer.apple.com/forums/thread/721918)), wired by
+the plist's `AssociatedBundleIdentifiers`. The full working recipe:
+
+1. **Ship a real `.app`** — `pkgs/nas-mount` builds
+   `$out/Applications/NasMount.app` (Info.plist:
+   `CFBundleIdentifier = net.kris.nas-mount`, `LSUIElement = true` for
+   no-Dock background apps, `CFBundleIconFile` → an icns) alongside
+   `bin/nas-mount`. Icon rendered once from an SF Symbol by the checked-in
+   `pkgs/nas-mount/make-icon.swift` (`swift make-icon.swift out.iconset &&
+   iconutil -c icns out.iconset` — run with `env -u SDKROOT`, the dev
+   shell's nix apple-sdk poisons the system Swift toolchain).
+2. **Ad-hoc sign the bundle at build time** — `rcodesign sign` in
+   **`postFixup`**. Not optional: rustc's linker signs the standalone
+   Mach-O, but that seals no Info.plist/Resources, so the enclosing bundle
+   is an *invalid code object* — launchd refuses to spawn it with
+   `last exit code = 78: EX_CONFIG` and an **empty job log** (`codesign -v`
+   on the bundle: "code has no resources but signature indicates they must
+   be present"). postFixup, not postInstall: fixupPhase's `strip` runs after
+   install and invalidates earlier signatures.
+3. **Plist**: `ProgramArguments[0]` inside the deployed app +
+   `AssociatedBundleIdentifiers = [ <bundle id> ]`. nix-darwin's
+   `launchd.user.agents` serviceConfig is a **closed submodule without that
+   key** — write the plist yourself into `environment.userLaunchAgents`
+   (which is the only thing `launchd.user.agents` feeds anyway).
+4. **Deploy outside the store + `lsregister -f`** — the module copies the
+   app to `~/Applications` (stamp-file guard: re-copy only when the store
+   path changed, so a manual Developer ID signature survives unrelated
+   `nrs` runs; `chmod -R u+w` after — `cp` preserves the store's read-only
+   bits and signing must write into the bundle). Then
+   `/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f <app>`:
+   a cp-installed bundle is invisible to LaunchServices, and Login Items
+   resolves the association through LS — without it the entry shows a blank
+   icon and the bare developer name.
+5. **Bust the BTM cache** — BTM keys its record on the plist *path* and
+   never re-reads on content change (survives `launchctl bootout` +
+   `bootstrap`). Refresh: `launchctl bootout gui/$UID/<label>`, `rm` the
+   plist, wait ~60–75 s for btmd to drop the record, restore the plist,
+   `launchctl bootstrap gui/$UID <plist>`, then **⌘Q and reopen System
+   Settings** (the pane caches too). `sfltool resetbtm` also works but
+   nukes/re-prompts every login item on the machine.
+6. **Sign the deployed bundle** (Developer ID, on top of the build-time
+   ad-hoc signature) whenever the app was re-copied. For nas-mount this is
+   automated at activation (next section); for other agents it's the manual
+   `sign-launchd-agents` run.
+
+End state, verified live: Login Items shows **NasMount**, custom icon,
+`Developer Name: Kris Williams`, `Team Identifier: Y6VCVC728W`.
+**Notarization is NOT required** — `spctl -a` still reports "Unnotarized
+Developer ID", which is irrelevant for locally-installed agents (no
+quarantine bit).
+
+## Automated activation-time signing (nas-mount)
+
+Since 2026-07-10 `modules/darwin/nas-mount.nix` signs the deployed bundle
+itself during `postActivation`, replacing the manual `sign-launchd-agents`
+chore *for this one agent*. The pieces:
+
+- **A dedicated identity, minted outside Keychain.** The key is generated
+  with openssl and never enters Keychain; the personal Keychain identity is
+  never exported. Minting:
+
+  ```sh
+  cd "$(mktemp -d)"
+  # PKCS#8 framing ("BEGIN PRIVATE KEY") is REQUIRED — rcodesign's
+  # --pem-file parser ignores legacy PKCS#1 "BEGIN RSA PRIVATE KEY".
+  openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out nas-signing.key
+  openssl req -new -key nas-signing.key -out nas-signing.certSigningRequest \
+    -subj "/emailAddress=kris@kris.net/CN=Kris Williams/C=US"
+  # developer.apple.com → Certificates → "+" → Developer ID Application
+  # (NOT Apple Development/Distribution) → upload CSR → download .cer.
+  openssl x509 -inform DER -in developerID_application.cer -out leaf.pem
+  curl -sO https://www.apple.com/certificateauthority/DeveloperIDG2CA.cer
+  openssl x509 -inform DER -in DeveloperIDG2CA.cer -out devid-ca.pem
+  openssl verify -partial_chain -CAfile devid-ca.pem leaf.pem   # sanity
+  cat nas-signing.key leaf.pem devid-ca.pem > nas-signing.pem
+  ```
+
+- **PEM ordering is load-bearing.** rcodesign's `--pem-file` help: there
+  must be 0 or 1 signing keys present, and *the first encountered
+  certificate is paired with the key* — all remaining certs become the
+  embedded CA chain. So: key, then leaf, then intermediate. (rcodesign
+  auto-registers Apple's chain for Apple-issued certs, but embedding the
+  G2 intermediate keeps the signature self-contained.)
+- **Storage: sops.** The PEM lives as `nas-signing-pem` in
+  `modules/hosts/k/secrets.yaml`
+  (`sops set modules/hosts/k/secrets.yaml '["nas-signing-pem"]' "$(jq -Rs . nas-signing.pem)"`),
+  declared with `owner = "k"` in `modules/hosts/k/default.nix` — the
+  signing step runs `sudo -u k` and the default `root:staff 0400` is
+  unreadable there. sops-nix installs `/run/secrets/*` at postActivation
+  order 1500 (`mkAfter`); the nas-mount block runs at 1600 in the *same*
+  `darwin-rebuild switch`. **sops-nix validates at build time that every
+  declared secret exists in the sops file** — declare the secret only
+  after the key is in secrets.yaml or the build fails.
+- **The trigger** is a fresh stamp-guarded copy OR `codesign -dvv` lacking
+  `Authority=Developer ID Application` (never gate on `TeamIdentifier=` —
+  a wrong-type cert matches it). Failures warn without failing activation
+  and re-arm the next run.
+- **Rotation** = mint a new key/CSR/cert (steps above), replace the sops
+  value, `nrs`. **Revocation** (leak response, not routine) = revoke just
+  the dedicated cert with Apple — the Keychain identity is untouched.
+  Public-repo caveat: the encrypted blob is permanent in git history and
+  encrypted only to host k's ssh-host-key-derived age key; rotation IS the
+  recovery story.
+
+## Learned behaviours & workarounds
+
+- **(2026-07-10) sops-nix fails the whole system build when a declared
+  secret's key is missing from the sops file** — `sops-install-secrets:
+  manifest is not valid: … the key 'x' cannot be found` from the
+  `manifest.json` derivation. Add the key to secrets.yaml *before*
+  declaring `sops.secrets.x`.
+- **(2026-07-10) rcodesign `--pem-file` pairs the FIRST certificate with
+  the signing key** and requires PKCS#8 (`BEGIN PRIVATE KEY`) framing;
+  leaf-before-intermediate ordering in a concatenated PEM is mandatory.
+- **(2026-07-09) Developer ID signing a bare launchd executable does not
+  fix "unidentified developer"** — only an associated .app bundle does (see
+  recipe above). Don't spend time on notarization for this either; it was
+  not needed.
+- **(2026-07-09) An unsigned bundle wrapping a linker-signed binary is an
+  invalid code object** — launchd `EX_CONFIG` with an empty job log looks
+  like a config error but is a signature problem; `codesign -v <app>` names
+  it. Keyless `rcodesign sign` in postFixup fixes it permanently.
+- **(2026-07-09) BTM caches by plist path; content changes never refresh
+  it.** After changing a plist's exec path or signing its app: bootout →
+  rm plist → ~75 s → restore → bootstrap → reopen Settings.
+- **(2026-07-09) `sfltool dumpbtm` fires an admin auth prompt per
+  invocation** — fine once for diagnosis, hostile in loops. The Settings
+  pane (after ⌘Q) is the readout.
+- **(2026-07-09) A "wrong" identity still signs successfully.** An Apple
+  Development cert yields a valid timestamped signature with the right
+  TeamIdentifier — check `Authority=Developer ID Application: …`
+  specifically, not just that a signature exists.
+- **(2026-07-09) `CSSMERR_TP_NOT_TRUSTED` / `Permission denied` from
+  codesign with a valid-looking cert** = missing Apple intermediate (G1 vs
+  G2 — match AKI↔SKI), or the key's ACL not yet granted, or you're not in a
+  real user session. In that order.
+- **(2026-07-09) The dev shell breaks the system Swift toolchain** — nix's
+  apple-sdk sets `SDKROOT`, and `swift` then fails with `no such module
+  'SwiftShims'`. `env -u SDKROOT PATH=/usr/bin:/bin xcrun swift …` for
+  one-off AppKit scripts like the icon generator.
+- **(2026-07-09) `pkgs.writeShellScript` leaks the store hash into Login
+  Items** — it puts the file at the store path's top level, so the
+  executable's own basename is `<hash>-name`. Anything `bin/`-nested
+  (`writeShellScriptBin`, a real package) displays clean.
+
+## Sources
+
+- Live verification on host `k` 2026-07-09: `codesign -dv`, `spctl -a`,
+  `sfltool dumpbtm`, `launchctl print`, `lsregister`, System Settings pane;
+  full narrative in `knowledge/decisions/nas-mount-codesigning.md`.
+- [Apple DTS on AssociatedBundleIdentifiers](https://developer.apple.com/forums/thread/721918)
+- [Apple PKI intermediates](https://www.apple.com/certificateauthority/)
+- [rcodesign / apple-codesign](https://github.com/indygreg/apple-platform-rs)
+- Worked example: `modules/darwin/nas-mount.nix`, `pkgs/nas-mount/`,
+  `scripts/sign-launchd-agents.ts`, PR #32.
diff --git a/docs/unifi-dream-machine.md b/docs/unifi-dream-machine.md
index d968901c..f93e5243 100644
--- a/docs/unifi-dream-machine.md
+++ b/docs/unifi-dream-machine.md
@@ -23,6 +23,23 @@ Two independent naming systems run in parallel; they are **not** in conflict:
   - **The static-DNS record set is separate again** — confirmed empty via `unifi_list_dns_records` before we touched anything. It manages a third, independent list (the DNS API / DNSControl / this MCP server's `create/update/delete_dns_record`) that doesn't see or shadow either of the above. Creating a static A record for an IP that already has a Local DNS Record (mechanism 2) enabled is rejected outright: `api.err.StaticDnsOverlapsWithDeviceLocalDns`.
   - To fully replace `home-unas-pro-4.home.lan` you'd have to change the client's raw `hostname`, a different and untested action — not something we've done.
 
+## Mounting via `nas.home.lan` (SMB) — tested 2026-07-09
+
+`mount_smbfs -N //k@nas.home.lan/Personal-Drive <mountpoint>` (the `-N` flag uses keychain-only auth, no interactive prompt — required for anything non-interactive, including a launchd agent) failed with **`File exists`** while the existing Bonjour-based mount (`//k@UNAS-Pro._smb._tcp.local/Personal-Drive`) was still active — **not a DNS or auth problem**. macOS's SMB client recognizes both hostnames as the *same negotiated server identity* (they resolve to the same box) and refuses a second concurrent mount of the same share. Confirmed the mechanism by unmounting the Bonjour-based mount first (`diskutil unmount /Volumes/Personal-Drive`) and retrying: `nas.home.lan` mounted cleanly, browsed correctly, and reported real capacity (3.7T / 155G used). The `-N` keychain lookup also succeeded with no prior credential entry made under that literal hostname — another sign macOS keys the keychain match off the server's canonical identity, not the connect string.
+
+Practical upshot: **you can have `nas.home.lan` *or* the Bonjour name mounted, never both at once.** Kris now mounts permanently at `~/nas` via `nas.home.lan` (module below); Time Machine stays on the Bonjour destination as before (unaffected — separate share, separate mount).
+
+**Persistent auto-mount:** `modules/darwin/nas-mount.nix` (`flake.modules.darwin.nas-mount`, gated behind `services.nas-mount.enable`, flipped on for host `k`) — a `launchd.user.agents.nas-mount` job, `RunAtLoad` + `StartInterval = 300` (retries every 5 min in case the NAS/network wasn't up yet at login), running an idempotent `mkdir -p ~/nas && mount_smbfs -N ... ~/nas` guarded by a `mount | grep` check so re-runs are harmless.
+
+## Codesigning the agent (moved)
+
+Everything about signing `nas-mount` — the Developer ID identity setup, the
+`sign-launchd-agents` batch tool, and the full "Item from unidentified
+developer" fix (the `.app` bundle + `AssociatedBundleIdentifiers` +
+LaunchServices + BTM-cache recipe) — lives in its own manual now:
+**[docs/darwin-codesigning.md](darwin-codesigning.md)**. It applies to any
+darwin launchd agent, not just this one; `nas-mount` is the worked example.
+
 ## Scan toolkit (macOS)
 
 ```sh
@@ -124,6 +141,8 @@ Auth model (from `api_auth.py`/`api_transport.py`): **session-cookie login** (`P
 
 ## Learned behaviours & workarounds
 
+- Codesigning/Login-Items gotchas moved to [darwin-codesigning.md](darwin-codesigning.md)'s own learned-behaviours section.
+- **(2026-07-09) `lsof +D` on an SMB mount hangs and itself pins the mount busy.** Debugging a "resource busy" unmount by running `lsof +D /Users/k/nas` makes it worse: lsof walks the whole network tree, never returns, and its own open references then keep the mount busy — a self-inflicted deadlock that survives until the lsof processes are killed (`pkill -f 'lsof.*nas'`, then `diskutil unmount` succeeds). Check `ps ax | grep lsof` for stuck walkers before believing "something else" holds an SMB mount.
 - **(2026-07-09) "SMB uses a different DNS" was Bonjour, not DNS.** Finder mounts via mDNS service discovery (`UNAS-Pro._smb._tcp.local`); the `home.lan` name never enters the SMB path. Check `mount | grep smb` before chasing DNS records.
 - **(2026-07-09) UDM reverse PTR returns `…id.ui.direct`, not `home.lan`.** UniFi's internal device identity — expected, not a misconfiguration.
 - **(2026-07-09) Can't fingerprint the Network version unauthenticated.** `/proxy/network/status` (which used to leak the version) now returns 401 on this firmware. Confirmed instead via an authenticated MCP call: **10.4.57**.
diff --git a/knowledge/decisions/index.md b/knowledge/decisions/index.md
index a0e1c446..4ed162b8 100644
--- a/knowledge/decisions/index.md
+++ b/knowledge/decisions/index.md
@@ -14,6 +14,7 @@ choice is made (the commit body can then simply link here).
 * [Shim The Chrome.app Path Instead Of Rewiring MCP Config](helium-chrome-shim.md) - Point Chrome-only tooling at Helium by planting an exec-wrapper at the path Puppeteer probes, rather than overriding the chrome-devtools-mcp plugin's args or replacing its MCP server.
 * [Home-manager Retirement](home-manager-retirement.md) - home-manager was removed entirely — every config is now a darwin module plus the stow tree, one evaluation model instead of two.
 * [Replace Lix With Determinate Nix](lix-to-determinate.md) - nebula's Nix moved from Lix to Determinate Nix because Lix lacks Nix ≥2.26 relative-path input locking, which made the ./flakes/* sub-flake inputs churn flake.lock on every rebuild.
+* [nas-mount Codesigning — Manual, Transient, Never Committed](nas-mount-codesigning.md) - Login Items shows "Unidentified Developer" for every nix-built launchd agent. Rejected both doing OS codesigning inside nix-darwin activation (fails — root cannot reach the login keychain's private-key ACL) and committing the exported private key via sops (real, permanent exposure of an Apple Developer ID for a cosmetic label). Landed on rcodesign + a transient, never-persisted .p12 export the machine owner runs by hand — kept over plain codesign specifically so the same approach can later run non-interactively in CI. rcodesign only signs Mach-O/bundle/DMG/pkg, so nas-mount became a compiled Rust binary (pkgs/nas-mount/) instead of a shell script.
 * [Manage Neovim Plugins with Native vim.pack](native-vim-pack.md) - Drop lazy.nvim for Neovim 0.12's built-in vim.pack, recreating lazy-loading with a ~160-line dispatcher instead of a third-party plugin manager.
 * [Unify nebula-snowglobe and main Into One Dual-OS Flake](nixos-darwin-unification.md) - Merged the orphan NixOS branch into main with --allow-unrelated-histories — one flake builds three darwin hosts and nebula; single nixpkgs on nixos-unstable (pinned at merge to nebula's rev), nebula's packages/ dissolved into pkgs/ + overlays, and the two class realisers (darwin.nix / nixos.nix) coexist unchanged.
 * [Facet Classify Providers — nix-optional-attrs and command](okf-facet-classify.md) - Generalize the facet build-side source from the Nix-only nix-packages table to a tagged classify union — the built-in nix-optional-attrs parser or an arbitrary command printing a JSON name->value map — so non-Nix repos can classify concepts by anything.
diff --git a/knowledge/decisions/nas-mount-codesigning.md b/knowledge/decisions/nas-mount-codesigning.md
new file mode 100644
index 00000000..a19be335
--- /dev/null
+++ b/knowledge/decisions/nas-mount-codesigning.md
@@ -0,0 +1,249 @@
+---
+type: Decision
+title: nas-mount Codesigning — Manual, Transient, Never Committed
+description: 'Login Items shows "Unidentified Developer" for every nix-built launchd agent. OS codesigning inside nix-darwin activation is impossible (root cannot reach the login keychain''s private-key ACL), and exporting/committing the personal Keychain identity stays forbidden. First landed on rcodesign + a transient, owner-run .p12 export; superseded 2026-07-10 by automated activation-time signing with a dedicated, purpose-minted Developer ID cert whose PEM (key born outside Keychain via openssl CSR) is sops-encrypted in git — rotation-first posture, CI never holds any key. rcodesign only signs Mach-O/bundle/DMG/pkg, so nas-mount became a compiled Rust binary (pkgs/nas-mount/) instead of a shell script.'
+tags: [darwin-module, codesigning, security, nas-mount]
+timestamp: '2026-07-09T19:35:00Z'
+---
+
+**Status:** active. **Where:** [nas-mount](../modules/nas-mount.md)
+(`modules/darwin/nas-mount.nix`), `docs/darwin-codesigning.md` ("Manually
+codesigning nas-mount").
+
+## Context
+
+macOS's System Settings > Login Items pane labels every nix-darwin-managed
+launchd item "Item from unidentified developer" — confirmed via
+`sfltool dumpbtm` that this is driven by whether the *executable at
+`Executable Path`* carries a real Apple Developer ID Team Identifier in its
+code signature, not by anything about how the plist was installed (even
+1Password's own hand-dropped LaunchAgent shows the same label; Determinate
+Systems' `determinate-nixd`, genuinely signed with Team ID `X3JQ4VPJZ6`,
+does not). Kris enrolled in the Apple Developer Program and obtained a real
+Developer ID Application certificate specifically to fix this for `nas-mount`.
+
+## Options considered
+
+1. **Do nothing.** Free, but the label stays. (Ultimately not chosen alone —
+   see below.)
+2. **Sign inside `system.activationScripts.postActivation`** using the OS
+   `codesign` tool against the identity now in Kris's login keychain.
+   **Ruled out — provably doesn't work.** `codesign` needs the private key,
+   which lives behind the login keychain's interactive ACL. Root-run
+   activation scripts (even via `launchctl asuser <uid>` to reattach to the
+   target user's GUI/Aqua session, not just a bare `sudo -u k` UID switch)
+   still hit `CSSMERR_TP_NOT_TRUSTED` / `Permission denied` — confirmed this
+   is a genuine macOS security boundary (the login keychain's private-key
+   material is walled off from root, even root attached to the right
+   session), not a fixable quoting/plumbing bug. Verified the identity and
+   trust chain themselves were fine throughout (`security verify-cert -p
+   codeSign` succeeded; the missing "Developer ID - G1" intermediate
+   certificate was identified by matching Authority/Subject Key Identifiers
+   and installed) — the failure was specifically about *who* can use the
+   key, not whether the cert chain was trusted.
+3. **Export the private key once, sops-encrypt it, commit it, decrypt +
+   sign automatically on every `nrs`.** Technically viable (`rcodesign`
+   signs directly from a `.p12`/PEM key pair, bypassing the Keychain/ACL
+   problem in option 2 entirely) — but **rejected**. This would move a real,
+   Apple-verified signing identity from Keychain's protected, effectively
+   non-exportable storage into a git-tracked encrypted blob that persists in
+   history *forever*, decrypted to a runtime path on every single
+   activation. The blast radius of that key ever leaking is someone signing
+   arbitrary software as "Kris Williams," trusted by Gatekeeper on other
+   people's Macs — a real, if Apple-revocable, reputational risk — for a
+   benefit that is purely cosmetic (a nicer label in a settings pane almost
+   nobody opens).
+4. **Export the private key transiently, sign manually, delete
+   immediately — never committed, never automated.** **Chosen.** `rcodesign`
+   sidesteps the keychain ACL problem the same way option 3 would, but the
+   key material only ever exists in a `mktemp -d` directory for the seconds
+   it takes to run the sign command, and only when Kris deliberately chooses
+   to run it himself. Nothing new is ever written to disk persistently or to
+   git.
+
+## Decision
+
+Keep `nas-mount.nix` simple: `system.activationScripts.postActivation` only
+copies the latest nix-built (unsigned) script to a stable external path
+(`~/.local/state/nas-mount/nas-mount` — needed regardless, since the nix
+store is read-only and its build sandbox has no keychain access either) —
+guarded by `cmp -s` so an existing manual signature survives any `nrs` that
+doesn't actually change the mount logic. Signing that stable path is a
+separate, manual, undocumented-in-nix procedure the machine owner runs
+himself in his own terminal — see `docs/darwin-codesigning.md` for the exact
+script. This is deliberately **not** wired into the flake at all: the whole
+point is that it must stay something a human chooses to do, not something
+that runs unattended.
+
+## Consequences
+
+- The real private key never leaves Keychain except for the brief window of
+  a manual re-sign; nothing new is ever committed.
+- Re-signing is a manual chore, needed again whenever `nas-mount.nix`'s
+  mount logic changes (the `cmp -s` guard means routine `nrs` runs that
+  don't touch it leave an existing signature alone).
+- If the identified-developer label is ever wanted for another custom
+  launchd module, this same manual procedure generalizes directly — no new
+  design needed, just point `rcodesign` at the new stable path.
+
+**Update (2026-07-09):** generalized into
+`scripts/sign-launchd-agents.ts` (bun, `rcodesign` added to the dev shell in
+`modules/dev.nix`) — an fzf picker over every plist in
+`~/Library/LaunchAgents`, showing each one's current signature status
+(Developer ID / Apple-signed-no-team / ad-hoc / unsigned / unresolved),
+Authority, and `Signed Time`, with multi-select so a whole batch signs off
+one passphrase entry instead of repeating the export per agent. Same
+transient-`.p12`-only posture; anything under `/nix/store/` is flagged and
+skipped (needs a stable-path module like `nas-mount.nix` first). Confirmed
+its signature-status parsing against live data on this machine — correctly
+distinguished `nas-mount` (unsigned), `/bin/launchctl` (Apple-signed, no
+team), and `cbm-daemon`/`gpg-connect-agent` (ad-hoc, `flags=0x20002(adhoc,
+linker-signed)` — Go/Rust linker auto-signing).
+
+**Bug found and fixed (2026-07-09):** the stable-path file ended up
+`r-xr-xr-x` (no write bit) — `cp` copies the nix store source's read-only
+mode, and `chmod +x` only ever adds execute bits, never touches read/write,
+so the missing write bit was permanent from the very first activation.
+`rcodesign sign-launchd-agents` correctly reported it as read-only and
+skipped it. Fixed by changing `chmod +x` to `chmod u+w,+x`, and — since
+permission bits don't affect a code signature — moved it **outside** the
+`cmp -s` content-diff guard so it re-asserts on every activation regardless
+of whether the mount logic changed, making it self-healing rather than a
+one-time fix.
+
+**Second bug found and fixed (2026-07-09):** signing then failed differently
+— `rcodesign` errored `specified path is not of a recognized type`.
+`rcodesign sign` only handles Mach-O binaries, bundles, DMGs, or `.pkg`
+installers — not a plain shell script, which `nas-mount` was (via
+`pkgs.writeShellScriptBin`). Considered switching the signer to plain OS
+`codesign` instead (which signs any file via its "signed generic" mode, and
+would work fine since this tool is always run in Kris's own interactive
+session) — **rejected**: the whole reason `rcodesign` was chosen over
+`codesign` in the first place is that it never touches the Keychain/session
+ACL at all, which is what will let this same signing approach eventually run
+non-interactively in GitHub CI (certs stored there securely — not
+implemented yet, noted for later). Plain `codesign` could never do that.
+Fixed the actual mismatch instead: rewrote `nas-mount` as a genuinely
+compiled Mach-O binary — `pkgs/nas-mount/` (`main.rs`, pure `std`, no
+external crates, built via a bare `rustc -O` in a plain `stdenv.mkDerivation`
+rather than `rustPlatform.buildRustPackage`'s Cargo.lock machinery),
+registered as a proper package (`modules/packages.nix`,
+`overlays/nas-mount.nix`) and referenced from `nas-mount.nix` as
+`pkgs.nas-mount` instead of `writeShellScriptBin`. `mountPoint`/`share` are
+now passed as CLI arguments (via launchd's `ProgramArguments`) rather than
+baked into the script text, so the binary itself stays generic. Bonus:
+rustc/the linker auto-ad-hoc-signs the output at build time
+(`flags=0x20002(adhoc,linker-signed)`, same as the Go-built `cbm-daemon`) —
+Login Items shows 🔏 ad-hoc instead of ❌ unsigned even before any manual
+`rcodesign` run.
+
+**Third bug found and fixed (2026-07-09):** signing succeeded (real,
+non-ad-hoc signature, `flags=0x0(none)`) but Login Items *still* showed
+"unidentified developer." `codesign -dv` on the result showed
+`Authority=Apple Development: Kris Williams (X8B24Z8GP2)` — a different cert
+than the "Developer ID Application: Kris Williams (Y6VCVC728W)" one set up
+for this — even though `TeamIdentifier=Y6VCVC728W` (same team) matched.
+Root cause: `security export -k ... -t identities -f pkcs12` exports **every
+identity in the keychain**, no exceptions — there is no `security export`
+flag that filters to one specific item (confirmed via web search: this is a
+documented, known limitation, not something scriptable around). Kris's
+keychain also holds an "Apple Development" cert (Xcode's local-testing
+identity, a different purpose/chain than distribution-grade "Developer ID
+Application"), and `rcodesign` — despite its own docs saying it errors when
+more than one signing key is present in a `.p12` — silently picked that one
+instead. "Apple Development" certs chain through Apple Worldwide Developer
+Relations, not the Developer ID Certification Authority chain Gatekeeper/BTM
+check for identified-developer attribution, so the label persisted despite
+a genuinely real signature.
+
+**Fix:** stopped calling `security export` programmatically at all. Both
+`sign-launchd-agents.ts` and the manual procedure in
+`docs/darwin-codesigning.md` now require exporting the *one* wanted
+identity yourself via Keychain Access.app's GUI (which does support
+selecting a single item — right-click → Export Items…) and just prompt for
+that `.p12` file's path plus its passphrase. Considered instead temporarily
+removing the "Apple Development" identity from the keychain before
+export — rejected as needlessly invasive to an unrelated Xcode-managed item
+for a session-scoped ambiguity that a one-time GUI export solves cleanly.
+
+**Final act (2026-07-09): the correct signature changed nothing — the label
+needs an app bundle, not a signature.** With the right Developer ID
+signature finally on the binary, BTM still recorded
+`Developer Name: (null)`. Apple's design (DTS,
+developer.apple.com/forums/thread/721918): Login Items attributes launchd
+items through an *associated app bundle* via the plist's
+`AssociatedBundleIdentifiers`, never through a bare executable's signature.
+Implemented: `pkgs/nas-mount` now also builds
+`$out/Applications/NasMount.app` (Info.plist, `net.kris.nas-mount`,
+`LSUIElement`, icns rendered from an SF Symbol by the checked-in
+`make-icon.swift`) — which conveniently also delivers the custom icon
+originally wished for. Four more load-bearing discoveries:
+
+1. **An unsigned bundle wrapping a linker-signed binary is an invalid code
+   object** — launchd refuses to spawn it (`EX_CONFIG`, empty job log,
+   `codesign -v`: "code has no resources but signature indicates they must
+   be present"). Fixed by `rcodesign sign` (keyless = ad-hoc) in
+   `postFixup` — pure Rust, sandbox-safe; postFixup because fixupPhase's
+   `strip` would invalidate an install-time signature.
+2. **nix-darwin's `launchd.user.agents` cannot express
+   `AssociatedBundleIdentifiers`** — its serviceConfig submodule is closed.
+   The module writes the plist itself into `environment.userLaunchAgents`
+   (which is all `launchd.user.agents` funnels into anyway).
+3. **A `cp`-installed app is invisible to LaunchServices**, and Login Items
+   resolves the association through LS — `lsregister -f` after the copy
+   (now in the module's postActivation) or the group shows a blank icon and
+   the bare developer name.
+4. **BTM caches by plist path and never re-reads on content change** — the
+   refresh is `launchctl bootout` + `rm` the plist, wait ~60–75s for btmd to
+   drop the record, restore, `bootstrap`, reopen System Settings. Also:
+   `sfltool dumpbtm` fires an admin auth prompt per invocation — don't poll
+   it; the Settings pane is the readout.
+
+End state verified live: Login Items shows **NasMount** with the custom
+icon; BTM: `Name: NasMount`, `Developer Name: Kris Williams`,
+`Team Identifier: Y6VCVC728W`. Notarization was **not** required
+(`spctl -a` still says "Unnotarized Developer ID" — irrelevant without a
+quarantine bit).
+
+**Update (2026-07-10): option 3 revived — with a dedicated identity, not
+the personal one.** Kris chose to automate the manual re-sign chore.
+Determinate Nix was investigated first and offers nothing here (its
+"signing" claims are its own notarized installer, Keychain TLS certs, and
+NAR cache signatures — zero Mach-O signing of user builds). The original
+option-3 rejection was re-read carefully: what made it unacceptable was
+exporting the *Keychain-held personal identity* into git history. The
+adopted variant changes exactly that term:
+
+- **A dedicated "Developer ID Application" cert is minted for this**
+  (openssl-generated PKCS#8 key → CSR → Apple portal; same team
+  Y6VCVC728W). The key is born outside Keychain and the personal identity
+  is never exported. Rotation = mint a new key/cert, replace the sops
+  value, `nrs`; leak response = revoke just this cert with Apple.
+- **The PEM (key + leaf + Developer ID G2 intermediate — leaf FIRST after
+  the key: rcodesign pairs the first certificate with the signing key and
+  treats the rest as the CA chain) is sops-encrypted** as
+  `nas-signing-pem` in `modules/hosts/k/secrets.yaml`, `owner = "k"`
+  (default `root:staff 0400` is unreadable by the `sudo -u k` activation
+  block). Accepted residual risk, eyes open: the repo is PUBLIC, the
+  encrypted blob is permanent in git history, and its only recipient is
+  host k's ssh-host-key-derived age key (no second recipient — a rebuilt
+  Mac cannot decrypt old ciphertext; rotation IS the recovery story).
+- **The module signs at activation**: sops-nix installs secrets at
+  postActivation order 1500 (`mkAfter`), the nas-mount block at 1600 runs
+  `rcodesign sign --pem-file /run/secrets/nas-signing-pem` on the deployed
+  bundle in the same `darwin-rebuild switch` — triggered by a fresh
+  stamp-guarded copy or a bundle whose `codesign -dvv` lacks
+  `Authority=Developer ID Application` (Authority, never TeamIdentifier —
+  see the Third bug above). Failures warn without failing activation.
+- **Signing inside the derivation was rejected outright** (the build
+  sandbox cannot see `/run/secrets`; any key routed into a build lands in
+  the world-readable store), and **CI never holds the signing key or any
+  age key** — builds do not decrypt sops secrets (see
+  [ci-github-actions](ci-github-actions.md)).
+- **Build-time gotcha:** sops-nix validates at build time that every
+  declared secret exists in the sops file — the `sops.secrets.nas-signing-pem`
+  declaration ships commented-out in `modules/hosts/k/default.nix` until
+  the minting procedure puts the key into secrets.yaml.
+
+`sign-launchd-agents` remains the manual tool for every *other* launchd
+agent; its transient-.p12 posture is unchanged.
diff --git a/knowledge/log.md b/knowledge/log.md
index cef64caa..73938b37 100644
--- a/knowledge/log.md
+++ b/knowledge/log.md
@@ -2,6 +2,26 @@
 
 ## 2026-07-10
 
+- **Update** — [nas-mount](modules/nas-mount.md) /
+  [nas-mount-codesigning](decisions/nas-mount-codesigning.md) /
+  `docs/darwin-codesigning.md`: automated the Developer ID re-sign chore.
+  First verified Determinate Nix offers nothing here (its "signing" = its
+  own notarized installer, Keychain TLS certs, NAR cache signatures — no
+  Mach-O signing of user builds; their own BTM answer is a signed binary
+  *outside* the store, same pattern as ours). The module now signs the
+  deployed bundle at activation via rcodesign + a **dedicated, purpose-
+  minted** Developer ID cert (openssl PKCS#8 key → CSR → portal; personal
+  Keychain identity never exported), PEM sops-encrypted as
+  `nas-signing-pem` (owner k; sops-nix installs at order 1500, module
+  signs at 1600 in the same switch; trigger = fresh copy or missing
+  `Authority=Developer ID Application`). Accepted, recorded risk: public
+  repo, blob permanent in history, single ssh-host-key-derived recipient —
+  rotation (new mint + sops replace) is the recovery story. Gotchas
+  learned: sops-nix fails the *build* when a declared secret is missing
+  from the sops file (declaration ships commented until the key exists);
+  rcodesign `--pem-file` demands PKCS#8 framing and pairs the FIRST
+  certificate with the key.
+
 - **Creation** — [helium-chrome-shim](modules/helium-chrome-shim.md) /
   [decision](decisions/helium-chrome-shim.md): dropped the chromium cask from
   [homebrew](modules/homebrew.md) (Helium is the browser now), which broke
@@ -20,6 +40,121 @@
 
 ## 2026-07-09
 
+- **Creation** — New manual `docs/darwin-codesigning.md`: extracted every
+  codesigning learning from the nas-mount arc out of the UDM manual into a
+  general-purpose reference — identity/cert-type pitfalls (Apple Development
+  vs Developer ID, missing G1 intermediate), codesign-vs-rcodesign trust
+  paths, the hard boundaries (root cannot reach login-keychain keys;
+  `security export` cannot filter to one identity), the
+  `sign-launchd-agents` tool, and the full Login Items attribution recipe
+  (.app bundle + AssociatedBundleIdentifiers + lsregister + BTM cache-bust;
+  notarization not required). `docs/unifi-dream-machine.md` slimmed to a
+  pointer; knowledge-bundle references repointed.
+
+- **Update** — [nas-mount](modules/nas-mount.md) /
+  [nas-mount-codesigning](decisions/nas-mount-codesigning.md): finished the
+  Login Items arc — a correct Developer ID signature on the bare binary
+  changed nothing; attribution needs an associated .app bundle
+  (`AssociatedBundleIdentifiers`, per Apple DTS). `pkgs/nas-mount` now also
+  builds an ad-hoc-signed `NasMount.app` (rcodesign in postFixup — an
+  unsigned bundle is an invalid code object launchd `EX_CONFIG`s), the
+  module deploys it to `~/Applications` (stamp-guarded copy + `lsregister
+  -f`, since cp-installed apps are invisible to LaunchServices) and writes
+  the plist via `environment.userLaunchAgents` (the `launchd.user.agents`
+  submodule is closed and lacks the key). BTM caches by plist path — bust
+  via bootout + rm-plist + ~75s wait + restore + bootstrap. Verified live:
+  Login Items shows **NasMount**, custom icon, `Developer Name: Kris
+  Williams`. Notarization not required.
+
+- **Update** — `scripts/sign-launchd-agents.ts`, `docs/unifi-dream-machine.md`:
+  fixed a wrong-identity bug. `security export -t identities` exports every
+  identity in the keychain with no per-item filter (confirmed a documented
+  CLI limitation, not something scriptable around); Kris's keychain also has
+  an "Apple Development" cert from Xcode, and `rcodesign` silently signed
+  `nas-mount` with that one instead of "Developer ID Application" —
+  producing a real (non-ad-hoc) signature that still left Login Items
+  showing "unidentified developer," since Apple Development certs don't
+  chain through the Developer ID authority BTM checks for. Fixed by
+  dropping the programmatic `security export` call entirely — both the
+  script and the manual doc procedure now prompt for a `.p12` path you
+  export yourself via Keychain Access.app (which supports selecting exactly
+  one identity). Write-up in
+  [nas-mount-codesigning](decisions/nas-mount-codesigning.md).
+- **Update** — [nas-mount](modules/nas-mount.md) /
+  [nas-mount package](packages/nas-mount.md): `rcodesign` errored `specified
+  path is not of a recognized type` signing the shell-script version — it
+  only handles Mach-O/bundle/DMG/pkg. Considered switching the signer to
+  plain OS `codesign` (works on any file, and would succeed here since the
+  tool always runs in Kris's own session) but rejected: `rcodesign` was
+  chosen specifically because it never touches Keychain/session ACLs, which
+  is what will let this same signing approach run in GitHub CI later (certs
+  stored there securely — not implemented yet). Rewrote `nas-mount` as a
+  genuinely compiled Mach-O binary instead — `pkgs/nas-mount/` (`main.rs`,
+  pure `std`, bare `rustc -O`, no Cargo), registered via
+  `modules/packages.nix` + `overlays/nas-mount.nix`, consumed as
+  `pkgs.nas-mount` in place of `writeShellScriptBin`; `mountPoint`/`share`
+  now passed as CLI args via launchd's `ProgramArguments`. Bonus: rustc
+  auto-ad-hoc-signs the binary at build time, upgrading Login Items from ❌
+  unsigned to 🔏 ad-hoc before any manual signing. Full write-up in
+  [nas-mount-codesigning](decisions/nas-mount-codesigning.md).
+- **Update** — [nas-mount](modules/nas-mount.md): fixed a real bug the new
+  `sign-launchd-agents` tool surfaced — the stable-path copy at
+  `~/.local/state/nas-mount/nas-mount` was `r-xr-xr-x` (no write bit)
+  because `cp` copies the nix store source's read-only mode and `chmod +x`
+  never grants write. Changed to `chmod u+w,+x` and moved it outside the
+  `cmp -s` content-diff guard (permission bits don't affect a code
+  signature, so it's safe — and now self-healing — to re-assert every
+  activation). See
+  [nas-mount-codesigning](decisions/nas-mount-codesigning.md) for the
+  write-up.
+- **Creation** — `scripts/sign-launchd-agents.ts`: generalized the manual
+  nas-mount codesigning procedure into an fzf-based batch tool over every
+  `~/Library/LaunchAgents` plist — shows signature status (Developer ID /
+  Apple-signed-no-team / ad-hoc / unsigned / unresolved), Authority, and
+  Signed Time per agent, with a live `codesign -dv` preview; multi-select
+  signs a whole batch off one passphrase export instead of one-at-a-time.
+  Added `rcodesign` to the dev shell (`modules/dev.nix`) so it's on PATH.
+  Verified the discovery/parsing logic against live data (correctly
+  classified `nas-mount` unsigned, `/bin/launchctl` Apple-signed-no-team,
+  `cbm-daemon`/`gpg-connect-agent` ad-hoc-linker-signed). Same
+  transient/never-committed `.p12` posture as the one-off script it
+  replaces for the multi-agent case — see
+  [nas-mount-codesigning](decisions/nas-mount-codesigning.md).
+  investigated clearing "unidentified developer" for `nas-mount` in Login
+  Items. Confirmed via `sfltool dumpbtm` the label tracks the executable's
+  own Developer ID Team Identifier, not plist installation method. Enrolled
+  in the Apple Developer Program, obtained a Developer ID Application
+  certificate, installed the missing "Developer ID - G1" intermediate
+  (matched via Authority/Subject Key Identifier). Proved codesigning from
+  `system.activationScripts` is structurally impossible — root (even via
+  `launchctl asuser`) cannot reach the login keychain's private key, a real
+  macOS security boundary. Rejected the alternative (sops-committing the
+  exported key for automated signing) as disproportionate permanent exposure
+  of a real signing identity for a cosmetic label. Landed on a manual,
+  transient `rcodesign` + `.p12`-export procedure the machine owner runs
+  himself, documented in `docs/unifi-dream-machine.md`; `nas-mount.nix`
+  simplified to just a `cmp -s`-guarded stable-path copy so a manual
+  signature survives routine `nrs` runs.
+- **Update** — [nas-mount](modules/nas-mount.md): fixed Login Items display —
+  switched `pkgs.writeShellScript` to `pkgs.writeShellScriptBin` so the
+  executable macOS shows in System Settings > Login Items is a clean
+  `nas-mount` rather than the hash-prefixed store-path basename
+  (`writeShellScript` outputs a bare file at the store path's top level;
+  `writeShellScriptBin` nests it under `$out/bin/`, so only the parent
+  directory carries the hash). While investigating, confirmed the unrelated
+  generic `sh` Login Items are nix-darwin/sops-nix's own `wait4path`-wrapped
+  system daemons (`activate-system`, `sops-install-secrets`) plus two
+  third-party agents (1Password's SSH_AUTH_SOCK helper, the Determinate Nix
+  installer's repair hook) — all expected, none of them ours to fix.
+- **Creation** — [nas-mount](modules/nas-mount.md)
+  (`modules/darwin/nas-mount.nix`): new darwin host-selective module, a
+  `launchd.user.agents` job that mounts the UNAS Pro 4's Personal-Drive SMB
+  share at `~/nas` via `nas.home.lan` at login (`-N` keychain-only auth,
+  `StartInterval` retry, idempotent mount-if-not-mounted guard). Enabled on
+  host `k`; built, activated via `nrs`, and confirmed live
+  (`launchctl list`, `mount`). Discovered while testing that mounting via
+  `nas.home.lan` conflicts with the pre-existing Bonjour-based mount — see
+  [unifi-dream-machine](../docs/unifi-dream-machine.md) for the root cause.
 - **Creation** — New manual `docs/unifi-dream-machine.md`: verified LAN DNS
   architecture (UDM dnsmasq `home.lan` vs the NAS's own mDNS/Bonjour identity
   — macOS SMB mounts ride Bonjour, not DNS), the three headless control paths
diff --git a/knowledge/modules/index.md b/knowledge/modules/index.md
index 7b7b0df6..8feb03cf 100644
--- a/knowledge/modules/index.md
+++ b/knowledge/modules/index.md
@@ -42,6 +42,7 @@ interesting ones by hand — scaffolding never overwrites an existing doc.
 * [Libreoffice Paths](libreoffice-paths.md) - Moves LibreOffice's user-writable paths out of ~/.config/libreoffice into XDG data/state dirs by seeding both the modern and legacy path nodes into registrymodifications.xcu — idempotent, skip-if-running, subshell-confined.
 * [Ly](ly.md) - Disables ly's F5/F6 brightness actions (and their hint-bar entries) by setting brightness_down_key/brightness_up_key to the literal "null" — ly itself is enabled by snowglobe's shared desktop layer.
 * [Macos Defaults](macos-defaults.md) - Kris' macOS defaults.
+* [Nas Mount](nas-mount.md) - Auto-mount the UNAS Pro 4's Personal-Drive SMB share at login via a launchd user agent.
 * [Codebase Memory Mcp](nebula-codebase-memory-mcp.md) - Flips services.codebase-memory-mcp.enable on nebula — the supervised code-graph daemon (systemd user service) + cbm-ctl from the fork's NixOS module.
 * [Neovim](neovim.md) - Installs Neovim plus every LSP/linter/formatter binary on the global PATH; the Lua config itself is stow-deployed and documented in the nvim knowledge area.
 * [Nh](nh.md) - nh (Nix Helper) plus the nrs/nrb/nrt rebuild helper executables (writeShellScriptBin, so they work in non-interactive shells and every shell alike).
diff --git a/knowledge/modules/nas-mount.md b/knowledge/modules/nas-mount.md
new file mode 100644
index 00000000..daa7b89a
--- /dev/null
+++ b/knowledge/modules/nas-mount.md
@@ -0,0 +1,90 @@
+---
+type: Darwin Module
+title: Nas Mount
+description: 'Auto-mount the UNAS Pro 4''s Personal-Drive SMB share at login via a launchd user agent.'
+resource: modules/darwin/nas-mount.nix
+tags: [darwin-module]
+timestamp: '2026-07-09T17:56:49+00:00'
+---
+
+Auto-mounts the UNAS Pro 4's Personal-Drive SMB share at `~/nas` at login via
+a `launchd.user.agents.nas-mount` job (`RunAtLoad` + `StartInterval = 300` to
+retry if the NAS/network wasn't up yet). Full backstory — how `nas.home.lan`
+was created as a UniFi "Local DNS Record" (not a static DNS entry), and why
+mounting via it conflicts with the pre-existing Bonjour-based mount (macOS
+treats both hostnames as the same negotiated server identity and refuses a
+second concurrent mount) — is in
+[docs/unifi-dream-machine.md](../../docs/unifi-dream-machine.md).
+
+**`-N` (keychain-only auth) is load-bearing, not cosmetic**: a launchd agent
+has no session to show an interactive password sheet, so the job only works
+because macOS already resolves a matching keychain entry for this server —
+confirmed the same entry serves both the Bonjour and DNS hostnames. The mount
+script is idempotent (`mount | grep` guard) so `RunAtLoad` firing against an
+already-mounted share is a harmless no-op.
+
+**A compiled binary (`pkgs/nas-mount/`), not a shell script.** Originally
+`pkgs.writeShellScriptBin`; rewritten (2026-07-09) to a genuine Mach-O binary
+— `main.rs` (pure `std`, no crates, built via a bare `rustc -O` rather than
+`rustPlatform.buildRustPackage`) — because `rcodesign` (the codesigning tool
+this module's ecosystem uses; see below) only recognizes Mach-O/bundle/DMG/pkg
+and errors `specified path is not of a recognized type` on a plain script.
+`mountPoint`/`share` are passed as CLI args via launchd's `ProgramArguments`
+rather than baked into the binary. Bonus: rustc/the linker auto-ad-hoc-signs
+the output at build time (`flags=0x20002(adhoc,linker-signed)`) — Login Items
+shows 🔏 ad-hoc rather than ❌ unsigned even before any manual signing.
+
+Either form (script or binary) already avoided the hash-prefixed-name
+problem the same way: the store path's *directory* carries the content hash,
+but `$out/bin/nas-mount` (what launchd actually execs) doesn't, so Login
+Items shows a clean `nas-mount`. `cbm-daemon`, `gh-config`, etc. show up
+clean the same way — while nix-darwin/sops-nix's own system daemons
+(`activate-system`, `sops-install-secrets`) show as generic `sh`: nix-darwin
+wraps *system* LaunchDaemons in a `/bin/sh -c "wait4path /nix/store && exec
+..."` trampoline upstream (guards against the store not being mounted yet at
+boot), which is out of any individual module's control.
+
+Imported on every darwin host but disabled by default — hosts opt in with
+`services.nas-mount.enable = true;`
+(see the [host-mounted modules pattern](../patterns/host-mounted-modules.md)):
+enabled on [k](../hosts/k.md), deliberately not on mini or SOC-Kris-Williams
+(personal NAS, personal machine); auto-discovered via the
+[Dendritic module layout](../patterns/dendritic-modules.md).
+
+**Login Items shows "NasMount" + custom icon + Kris's developer identity**
+(resolved 2026-07-09, after a long arc). Attribution needs an *associated
+app bundle*, not a signed executable — so `pkgs/nas-mount` also builds
+`NasMount.app` (ad-hoc signed at build time via rcodesign in postFixup; an
+unsigned bundle is an invalid code object launchd rejects with `EX_CONFIG`),
+the module deploys it to `~/Applications` with a stamp-guarded copy (so the
+Developer ID signature survives routine `nrs` runs) plus
+`lsregister -f` (cp-installed apps are invisible to LaunchServices), and the
+launchd plist — written via `environment.userLaunchAgents` because the
+`launchd.user.agents` submodule is closed and lacks the key — carries
+`AssociatedBundleIdentifiers = [ net.kris.nas-mount ]`. BTM caches by plist
+path; the module header documents the bootout + rm + wait + restore +
+bootstrap refresh dance. Full history (keychain ACL boundary, sops
+rejection, wrong-identity export, bundle requirement):
+[nas-mount-codesigning](../decisions/nas-mount-codesigning.md) and
+`docs/darwin-codesigning.md`.
+
+**Developer ID signing is automated at activation** (2026-07-10): the
+module runs `rcodesign sign --pem-file /run/secrets/nas-signing-pem` on the
+deployed bundle whenever the copy is fresh or `codesign -dvv` lacks
+`Authority=Developer ID Application` (Authority, never TeamIdentifier — a
+wrong-type cert matches the team). The PEM is a dedicated, purpose-minted
+identity (openssl CSR → Apple portal; the personal Keychain identity is
+never exported), sops-encrypted in `modules/hosts/k/secrets.yaml` with
+`owner = "k"`; sops-nix installs it at postActivation order 1500, the
+module signs at 1600 in the same switch. Failures warn without failing
+activation; a missing secret skips with a warning (and its declaration
+stays commented in the host file until the key exists — sops-nix fails the
+build otherwise). CI never holds the key
+([ci-github-actions](../decisions/ci-github-actions.md)).
+
+## Source
+
+- Module: [`modules/darwin/nas-mount.nix`](../../modules/darwin/nas-mount.nix)
+- Package: [`pkgs/nas-mount/`](../../pkgs/nas-mount/) (`main.rs`, `package.nix`)
+- Options under: `services.nas-mount`
+- Decision: [nas-mount-codesigning](../decisions/nas-mount-codesigning.md)
diff --git a/knowledge/packages/index.md b/knowledge/packages/index.md
index e57009a2..842b728c 100644
--- a/knowledge/packages/index.md
+++ b/knowledge/packages/index.md
@@ -17,6 +17,7 @@ flake consumes via relative-path inputs.
 * [Helium Config](helium-config.md) - Custom Nix package 'helium-config'.
 * [Iv](iv.md) - A command-line image viewer using terminal graphics.
 * [Kitten](kitten.md) - Kitten - A collection of small, useful programs for the kitty terminal.
+* [Nas Mount](nas-mount.md) - Mounts the UNAS Pro 4 Personal-Drive SMB share if not already mounted — a compiled Mach-O binary (pure-std Rust, no crates, bare rustc build) so rcodesign can sign it. Consumed by modules/darwin/nas-mount.nix.
 * [Noctalia Config](noctalia-config.md) - Custom Nix package 'noctalia-config'.
 * [okf](okf.md) - okf — CLI for maintaining OKF knowledge bundles (scaffold/index/validate/viz), consumed from its own repo, github:kriswill/okflight.
 * [Pass Xdg](pass-xdg.md) - pass-xdg — a drop-in `pass` (standard unix password manager) that defaults its store to an XDG-compliant location instead of the upstream default `~/.password-store`.
diff --git a/knowledge/packages/nas-mount.md b/knowledge/packages/nas-mount.md
new file mode 100644
index 00000000..b000c25e
--- /dev/null
+++ b/knowledge/packages/nas-mount.md
@@ -0,0 +1,38 @@
+---
+type: Nix Package
+title: Nas Mount
+description: 'Mounts the UNAS Pro 4 Personal-Drive SMB share if not already mounted — a compiled Mach-O binary (pure-std Rust, no crates, bare rustc build) so rcodesign can sign it. Consumed by modules/darwin/nas-mount.nix.'
+resource: pkgs/nas-mount/package.nix
+tags: [package, darwin-only, rust, codesigning]
+timestamp: '2026-07-09T20:09:02+00:00'
+---
+
+Mounts the UNAS Pro 4 Personal-Drive SMB share if not already mounted.
+Deliberately a compiled Mach-O binary rather than a shell script — see
+[nas-mount-codesigning](../decisions/nas-mount-codesigning.md): `rcodesign`
+(the codesigning tool `scripts/sign-launchd-agents.ts` uses) only recognizes
+Mach-O/bundle/DMG/pkg, not plain scripts. `main.rs` is pure `std`, no crates,
+built via a bare `rustc -O` inside a plain `stdenv.mkDerivation` rather than
+`rustPlatform.buildRustPackage`'s Cargo.lock machinery — there's nothing to
+vendor. Takes `<mount-point> <smb-share>` as CLI args (passed via launchd's
+`ProgramArguments` in the consuming module) rather than baking them in.
+
+Ships two outputs: `bin/nas-mount` (the CLI) and
+`Applications/NasMount.app` — a minimal bundle (`net.kris.nas-mount`,
+`LSUIElement`, icns rendered from an SF Symbol by the checked-in
+`make-icon.swift`) that exists so Login Items can attribute the launchd
+agent (`AssociatedBundleIdentifiers`) and show a custom icon. The bundle is
+ad-hoc signed at build time (`rcodesign sign` in postFixup — keyless, pure
+Rust, sandbox-safe; an unsigned bundle is an invalid code object launchd
+`EX_CONFIG`s, and postInstall signing would be invalidated by fixupPhase's
+strip). `bundleId` is an overridable argument.
+
+darwin-only (`meta.platforms`); registered in `modules/packages.nix` under
+the `aarch64-darwin` guard alongside `kitten`/`podman`.
+
+## Source
+
+- Package: [`pkgs/nas-mount/package.nix`](../../pkgs/nas-mount/package.nix)
+  + [`main.rs`](../../pkgs/nas-mount/main.rs)
+- Overlay: [`overlays/nas-mount.nix`](../../overlays/nas-mount.nix) — exposes `pkgs.nas-mount`
+- Consumer: [nas-mount module](../modules/nas-mount.md)
diff --git a/modules/darwin/nas-mount.nix b/modules/darwin/nas-mount.nix
new file mode 100644
index 00000000..ee9e3982
--- /dev/null
+++ b/modules/darwin/nas-mount.nix
@@ -0,0 +1,164 @@
+# Auto-mount the UNAS Pro 4's Personal-Drive SMB share at login via a launchd
+# user agent. See docs/unifi-dream-machine.md for how nas.home.lan (a UniFi
+# "Local DNS Record", not a static DNS entry) was set up. `-N` is required —
+# a launchd agent has no session to show an interactive password sheet, so it
+# only works because macOS already has a matching keychain entry (confirmed
+# 2026-07-09: the same entry serves both the Bonjour and DNS hostnames, since
+# macOS's SMB client keys off the server's negotiated identity, not the
+# literal string used to connect — see the manual's "two mechanisms" note).
+#
+# Why an .app bundle for a background mount helper: System Settings > Login
+# Items attributes a *bare* launchd agent to nobody — it reads "Item from
+# unidentified developer" no matter how well the executable itself is signed
+# (verified: signing the binary with a real Developer ID changed nothing).
+# Apple's documented answer (DTS, developer.apple.com/forums/thread/721918)
+# is to point the plist's AssociatedBundleIdentifiers at a real, signed app
+# bundle; that bundle is also what supplies the custom icon. So pkgs/nas-mount
+# ships both $out/bin/nas-mount and $out/Applications/NasMount.app.
+#
+# BTM cache gotcha: Background Task Management keys its record on the plist
+# path and does NOT re-read when the plist's contents change — after any
+# ProgramArguments/exec-path change (or after signing the app), the Login
+# Items pane keeps showing stale attribution even across launchctl
+# bootout/bootstrap. The only non-invasive refresh found (2026-07-09):
+# `launchctl bootout ...; rm <plist>`, wait a few seconds for btmd to drop
+# the record, restore the plist, `launchctl bootstrap ...`, then quit and
+# reopen System Settings. (`sfltool resetbtm` also works but nukes and
+# re-prompts EVERY login item on the machine.)
+#
+# Stable external path: the nix store is read-only, so the app is copied to
+# ~/Applications and the Developer ID signature goes on that copy. Signing is
+# automated in the activation block below via rcodesign + a dedicated
+# sops-held PEM identity (key + cert chain minted specifically for this —
+# NOT the personal Keychain identity, which stays non-exportable; see
+# knowledge/decisions/nas-mount-codesigning.md, 2026-07-10 update). rcodesign
+# signs from a key *file*, which sidesteps the login-keychain boundary that
+# rules out OS `codesign` here (confirmed 2026-07-09: macOS walls the login
+# keychain's private-key material off from root entirely, even via
+# `launchctl asuser`). The copy is guarded by a stamp file holding the source
+# store path, so the signature survives every `nrs` that doesn't actually
+# rebuild the app. `sign-launchd-agents` remains the manual tool for OTHER
+# launchd agents (see docs/darwin-codesigning.md).
+{
+  flake.modules.darwin.nas-mount =
+    {
+      lib,
+      config,
+      pkgs,
+      ...
+    }:
+    let
+      cfg = config.services.nas-mount;
+      home = "/Users/k";
+      mountPoint = "${home}/nas";
+      share = "//k@nas.home.lan/Personal-Drive";
+      bundleId = "net.kris.nas-mount";
+
+      mountPkg = pkgs.nas-mount.override { inherit bundleId; };
+      appSrc = "${mountPkg}/Applications/NasMount.app";
+      appDst = "${home}/Applications/NasMount.app";
+      execPath = "${appDst}/Contents/MacOS/nas-mount";
+      stamp = "${home}/.local/state/nas-mount/source-store-path";
+
+      # Developer ID signing of the deployed copy, run as user k during
+      # postActivation. sops-nix installs /run/secrets/* earlier in this SAME
+      # postActivation run (its installScript is lib.mkAfter = order 1500, we
+      # run at 1600), so the PEM is already present when the block executes.
+      # The `or` fallback keeps eval working on a host that enables nas-mount
+      # without declaring the secret — the runtime -r check warns and skips.
+      pemSecret = config.sops.secrets.nas-signing-pem.path or "/run/secrets/nas-signing-pem";
+      # Keep in sync with TIMESTAMP_URL in scripts/sign-launchd-agents.ts.
+      timestampUrl = "http://timestamp.apple.com/ts01";
+
+      # Written directly rather than via `launchd.user.agents`: that option's
+      # serviceConfig is a *closed* submodule (nix-darwin's modules/launchd/
+      # launchd.nix enumerates every allowed key) and has no
+      # AssociatedBundleIdentifiers — which is the one key this whole exercise
+      # needs. launchd.user.agents just funnels into environment.userLaunchAgents
+      # anyway (modules/launchd/default.nix), so write the plist ourselves.
+      plist = pkgs.writeText "org.nixos.nas-mount.plist" ''
+        <?xml version="1.0" encoding="UTF-8"?>
+        <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+        <plist version="1.0">
+        <dict>
+          <key>Label</key>
+          <string>org.nixos.nas-mount</string>
+          <key>AssociatedBundleIdentifiers</key>
+          <array>
+            <string>${bundleId}</string>
+          </array>
+          <key>ProgramArguments</key>
+          <array>
+            <string>${execPath}</string>
+            <string>${mountPoint}</string>
+            <string>${share}</string>
+          </array>
+          <key>RunAtLoad</key>
+          <true/>
+          <!-- retry if the NAS/network wasn't ready at login -->
+          <key>StartInterval</key>
+          <integer>300</integer>
+          <key>StandardOutPath</key>
+          <string>${home}/Library/Logs/nas-mount.log</string>
+          <key>StandardErrorPath</key>
+          <string>${home}/Library/Logs/nas-mount.log</string>
+        </dict>
+        </plist>
+      '';
+    in
+    {
+      options.services.nas-mount.enable = lib.mkEnableOption "auto-mount the UNAS Pro 4 Personal-Drive SMB share at login";
+      config = lib.mkIf cfg.enable {
+        environment.userLaunchAgents."org.nixos.nas-mount.plist".source = plist;
+
+        # Order 1600: same slot dotfiles-stow (1500) and other user-context
+        # postActivation steps use — see claude-account-selector/default.nix.
+        system.activationScripts.postActivation.text = lib.mkOrder 1600 ''
+          /usr/bin/sudo -u k --set-home /bin/sh -c '
+            set -e
+            mkdir -p "${home}/Applications" "$(dirname "${stamp}")"
+            # Re-copy only when the built app actually changed, so the
+            # signature on the copy survives unrelated `nrs` runs. The stamp
+            # holds the source store path (content-addressed, so a changed
+            # app == a changed path).
+            fresh=0
+            if [ "$(cat "${stamp}" 2>/dev/null)" != "${appSrc}" ]; then
+              rm -rf "${appDst}"
+              cp -R "${appSrc}" "${appDst}"
+              # cp preserves the store'"'"'s read-only mode; codesign/rcodesign
+              # must be able to write the signature into the bundle.
+              chmod -R u+w "${appDst}"
+              printf %s "${appSrc}" > "${stamp}"
+              # A cp-installed app is invisible to LaunchServices until
+              # registered, and Login Items resolves the bundle-id
+              # association through LS — without this the group shows a
+              # blank icon and the raw developer name only.
+              /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f "${appDst}"
+              fresh=1
+            fi
+            # Superseded by the .app bundle (was the pre-bundle exec target).
+            rm -f "${home}/.local/state/nas-mount/nas-mount"
+            # Developer ID signing with the dedicated sops-held identity.
+            # Trigger on a fresh copy (only ad-hoc-signed from the store) or
+            # a deployed bundle without a Developer ID signature (first
+            # rollout, an earlier failed sign, tampering). Gate on Authority=,
+            # NOT TeamIdentifier= — an Apple Development cert shows the same
+            # team through the wrong chain (see the decision record). A
+            # failure warns instead of failing activation; the Authority
+            # check re-arms the sign attempt on the next activation.
+            if [ "$fresh" = 1 ] || ! /usr/bin/codesign -dvv "${appDst}" 2>&1 | grep -q "Authority=Developer ID Application"; then
+              if [ -r "${pemSecret}" ]; then
+                if ${pkgs.rcodesign}/bin/rcodesign sign --pem-file "${pemSecret}" --timestamp-url "${timestampUrl}" "${appDst}"; then
+                  echo "nas-mount: signed ${appDst} with Developer ID" >&2
+                else
+                  echo "nas-mount: WARNING: Developer ID signing failed; bundle keeps its current signature" >&2
+                fi
+              else
+                echo "nas-mount: WARNING: signing PEM ${pemSecret} missing or unreadable; skipping Developer ID signing" >&2
+              fi
+            fi
+          '
+        '';
+      };
+    };
+}
diff --git a/modules/dev.nix b/modules/dev.nix
index 380d4e51..a1c5f484 100644
--- a/modules/dev.nix
+++ b/modules/dev.nix
@@ -21,6 +21,10 @@
             ssh-to-age
             # Dotfiles management
             stow
+            # macOS codesigning without touching Keychain/ACLs — see
+            # scripts/sign-launchd-agents.ts and
+            # knowledge/decisions/nas-mount-codesigning.md
+            rcodesign
             ;
           # `okf` on the dev-shell PATH (scaffold|index|validate|viz) — the
           # nix-built CLI from the okflight input (github:kriswill/okflight).
diff --git a/modules/hosts/k/default.nix b/modules/hosts/k/default.nix
index 68f45eea..28ea18fc 100644
--- a/modules/hosts/k/default.nix
+++ b/modules/hosts/k/default.nix
@@ -28,11 +28,26 @@
     # with real secrets as they arrive; edit with `sops modules/hosts/k/secrets.yaml`.
     sops.defaultSopsFile = ./secrets.yaml;
     sops.secrets.sops-smoke-test = { };
+    # Dedicated "Developer ID Application" signing identity for automated
+    # nas-mount bundle signing (modules/darwin/nas-mount.nix). PEM layout:
+    # PKCS#8 private key, then the leaf cert, then the Apple Developer ID G2
+    # intermediate — rcodesign pairs the FIRST certificate with the key.
+    # Purpose-minted via openssl CSR → Apple portal, NOT the Keychain
+    # identity; rotate by minting a new key/CSR/cert and replacing this
+    # value (docs/darwin-codesigning.md). owner k: the signing step runs
+    # `sudo -u k` inside postActivation, and the default root:staff 0400
+    # is unreadable there.
+    # UNCOMMENT once the `nas-signing-pem` key exists in secrets.yaml —
+    # sops-nix validates at build time that every declared secret exists,
+    # so declaring it early breaks the build (verified 2026-07-10). Until
+    # then modules/darwin/nas-mount.nix warns-and-skips at activation.
+    # sops.secrets.nas-signing-pem.owner = "k";
 
     # Host-selective features: their modules are imported on every host but
     # ship disabled; enabling here is what mounts them into k.
     services.apple-container.enable = true;
     services.codebase-memory-mcp.enable = true;
+    services.nas-mount.enable = true;
     programs.podman-desktop.enable = true;
 
     programs.claude-account-selector = {
diff --git a/modules/overlays.nix b/modules/overlays.nix
index 791b41dc..162a97b3 100644
--- a/modules/overlays.nix
+++ b/modules/overlays.nix
@@ -9,6 +9,7 @@
 {
   flake.overlays = {
     kitten = import ../overlays/kitten.nix;
+    nas-mount = import ../overlays/nas-mount.nix;
     direnv = import ../overlays/direnv.nix;
     dots-adopt = import ../overlays/dots-adopt.nix;
     podman = import ../overlays/podman.nix;
diff --git a/modules/packages.nix b/modules/packages.nix
index 431e006a..d4be1634 100644
--- a/modules/packages.nix
+++ b/modules/packages.nix
@@ -47,6 +47,8 @@
         podman = pkgs.callPackage ../pkgs/podman.nix { };
         # kitten ships as a prebuilt darwin-arm64 binary.
         kitten = pkgs.callPackage ../pkgs/kitten.nix { };
+        # nas-mount — compiled Mach-O mount helper (modules/darwin/nas-mount.nix).
+        nas-mount = pkgs.callPackage ../pkgs/nas-mount/package.nix { };
       }
       # Linux-only: wowup wraps an AppImage (needs the appimage runtime);
       # flatpak-user shims a Linux-only package manager.
diff --git a/overlays/nas-mount.nix b/overlays/nas-mount.nix
new file mode 100644
index 00000000..0dfe829e
--- /dev/null
+++ b/overlays/nas-mount.nix
@@ -0,0 +1,3 @@
+_final: prev: {
+  nas-mount = prev.callPackage ../pkgs/nas-mount/package.nix { };
+}
diff --git a/pkgs/nas-mount/main.rs b/pkgs/nas-mount/main.rs
new file mode 100644
index 00000000..4f3e0030
--- /dev/null
+++ b/pkgs/nas-mount/main.rs
@@ -0,0 +1,50 @@
+// Mounts an SMB share at a given mount point if it isn't already mounted.
+// Deliberately a compiled Mach-O binary rather than a shell script: rcodesign
+// (used to sign it for a nicer System Settings > Login Items identity — see
+// scripts/sign-launchd-agents.ts and knowledge/decisions/nas-mount-codesigning.md)
+// only recognizes Mach-O/bundle/DMG/pkg, not plain scripts.
+//
+// usage: nas-mount <mount-point> <smb-share>
+
+use std::env;
+use std::fs;
+use std::process::{Command, ExitCode};
+
+fn main() -> ExitCode {
+    let args: Vec<String> = env::args().collect();
+    let [mount_point, share] = match &args[1..] {
+        [mount_point, share] => [mount_point, share],
+        _ => {
+            eprintln!("usage: nas-mount <mount-point> <smb-share>");
+            return ExitCode::FAILURE;
+        }
+    };
+
+    if let Err(e) = fs::create_dir_all(mount_point) {
+        eprintln!("mkdir -p {mount_point} failed: {e}");
+        return ExitCode::FAILURE;
+    }
+
+    let already_mounted = match Command::new("/sbin/mount").output() {
+        Ok(o) => String::from_utf8_lossy(&o.stdout).contains(&format!(" on {mount_point} ")),
+        Err(e) => {
+            eprintln!("mount failed: {e}");
+            return ExitCode::FAILURE;
+        }
+    };
+    if already_mounted {
+        return ExitCode::SUCCESS;
+    }
+
+    match Command::new("/sbin/mount_smbfs").arg("-N").arg(share).arg(mount_point).status() {
+        Ok(s) if s.success() => ExitCode::SUCCESS,
+        Ok(s) => {
+            eprintln!("mount_smbfs exited with {s}");
+            ExitCode::FAILURE
+        }
+        Err(e) => {
+            eprintln!("mount_smbfs failed: {e}");
+            ExitCode::FAILURE
+        }
+    }
+}
diff --git a/pkgs/nas-mount/make-icon.swift b/pkgs/nas-mount/make-icon.swift
new file mode 100644
index 00000000..73c88171
--- /dev/null
+++ b/pkgs/nas-mount/make-icon.swift
@@ -0,0 +1,66 @@
+// Renders an SF Symbol (external drive + network) onto a rounded-rect tile
+// at every size an .iconset needs. Run: swift make-icon.swift <outdir>
+import AppKit
+
+let args = CommandLine.arguments
+guard args.count == 2 else { fputs("usage: make-icon.swift <outdir>\n", stderr); exit(1) }
+let outDir = URL(fileURLWithPath: args[1], isDirectory: true)
+try FileManager.default.createDirectory(at: outDir, withIntermediateDirectories: true)
+
+let sizes: [(name: String, px: Int)] = [
+  ("icon_16x16", 16), ("icon_16x16@2x", 32),
+  ("icon_32x32", 32), ("icon_32x32@2x", 64),
+  ("icon_128x128", 128), ("icon_128x128@2x", 256),
+  ("icon_256x256", 256), ("icon_256x256@2x", 512),
+  ("icon_512x512", 512), ("icon_512x512@2x", 1024),
+]
+
+func render(px: Int) -> NSImage {
+  let s = CGFloat(px)
+  let img = NSImage(size: NSSize(width: s, height: s))
+  img.lockFocus()
+  defer { img.unlockFocus() }
+
+  // Rounded-rect tile, macOS-style inset (~10% margin), kanagawa-ish deep blue
+  let inset = s * 0.05
+  let tile = NSBezierPath(
+    roundedRect: NSRect(x: inset, y: inset, width: s - 2 * inset, height: s - 2 * inset),
+    xRadius: s * 0.22, yRadius: s * 0.22)
+  let top = NSColor(calibratedRed: 0.14, green: 0.16, blue: 0.23, alpha: 1)      // #242938-ish
+  let bottom = NSColor(calibratedRed: 0.10, green: 0.11, blue: 0.16, alpha: 1)
+  NSGradient(starting: top, ending: bottom)?.draw(in: tile, angle: -90)
+
+  // SF Symbol glyph centered, light foreground
+  let cfg = NSImage.SymbolConfiguration(pointSize: s * 0.52, weight: .medium)
+  guard
+    let sym = NSImage(systemSymbolName: "externaldrive.connected.to.line.below",
+                      accessibilityDescription: nil)?
+      .withSymbolConfiguration(cfg)
+  else { fputs("symbol not found\n", stderr); exit(2) }
+
+  let tinted = NSImage(size: sym.size)
+  tinted.lockFocus()
+  NSColor(calibratedRed: 0.85, green: 0.87, blue: 0.91, alpha: 1).set()
+  let r = NSRect(origin: .zero, size: sym.size)
+  sym.draw(in: r)
+  r.fill(using: .sourceAtop)
+  tinted.unlockFocus()
+
+  let g = tinted.size
+  let scale = (s * 0.62) / max(g.width, g.height)
+  let w = g.width * scale, h = g.height * scale
+  tinted.draw(
+    in: NSRect(x: (s - w) / 2, y: (s - h) / 2, width: w, height: h),
+    from: .zero, operation: .sourceOver, fraction: 1.0)
+  return img
+}
+
+for (name, px) in sizes {
+  let img = render(px: px)
+  guard let tiff = img.tiffRepresentation,
+        let rep = NSBitmapImageRep(data: tiff) else { exit(3) }
+  rep.size = NSSize(width: px, height: px)
+  guard let png = rep.representation(using: .png, properties: [:]) else { exit(4) }
+  try png.write(to: outDir.appendingPathComponent("\(name).png"))
+}
+print("wrote \(sizes.count) pngs to \(outDir.path)")
diff --git a/pkgs/nas-mount/nas-mount.icns b/pkgs/nas-mount/nas-mount.icns
new file mode 100644
index 00000000..d8dcdbf5
Binary files /dev/null and b/pkgs/nas-mount/nas-mount.icns differ
diff --git a/pkgs/nas-mount/package.nix b/pkgs/nas-mount/package.nix
new file mode 100644
index 00000000..57cfe890
--- /dev/null
+++ b/pkgs/nas-mount/package.nix
@@ -0,0 +1,100 @@
+# Compiled (not shell-scripted) mount helper for the UNAS Pro 4 SMB share —
+# see main.rs for why it's a Mach-O binary rather than a script. No external
+# crates (pure std), so a bare rustc invocation rather than
+# rustPlatform.buildRustPackage's Cargo.lock machinery.
+#
+# Two outputs in one derivation:
+#   $out/bin/nas-mount              — the CLI, what launchd actually execs
+#   $out/Applications/NasMount.app  — a real .app bundle wrapping that binary
+#
+# The .app exists solely to fix System Settings > Login Items attribution:
+# a bare launchd agent has nothing for TCC to attribute, so it reads
+# "Item from unidentified developer" no matter how well its executable is
+# signed. Apple's documented answer (DTS, developer.apple.com/forums/thread/721918)
+# is to point the plist's AssociatedBundleIdentifiers at a real, signed app
+# bundle — which is also what supplies the custom icon. See
+# knowledge/decisions/nas-mount-codesigning.md.
+#
+# nas-mount.icns is generated by make-icon.swift (checked in beside it,
+# rendered from an SF Symbol); regenerate with:
+#   swift make-icon.swift out.iconset && iconutil -c icns out.iconset
+{
+  stdenv,
+  rustc,
+  rcodesign,
+  bundleId ? "net.kris.nas-mount",
+}:
+stdenv.mkDerivation {
+  pname = "nas-mount";
+  version = "0.1.0";
+  dontUnpack = true;
+  # rcodesign ad-hoc signs the finished bundle (see postInstall). It's pure
+  # Rust and never touches the Keychain, so unlike Apple's `codesign` it works
+  # inside the nix build sandbox.
+  nativeBuildInputs = [
+    rustc
+    rcodesign
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    rustc -O -o nas-mount ${./main.rs}
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    cp nas-mount $out/bin/nas-mount
+
+    app=$out/Applications/NasMount.app
+    mkdir -p "$app/Contents/MacOS" "$app/Contents/Resources"
+    cp nas-mount "$app/Contents/MacOS/nas-mount"
+    cp ${./nas-mount.icns} "$app/Contents/Resources/nas-mount.icns"
+
+    cat > "$app/Contents/Info.plist" <<EOF
+    <?xml version="1.0" encoding="UTF-8"?>
+    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+    <plist version="1.0">
+    <dict>
+      <key>CFBundleIdentifier</key>       <string>${bundleId}</string>
+      <key>CFBundleName</key>             <string>NasMount</string>
+      <key>CFBundleDisplayName</key>      <string>NAS Mount</string>
+      <key>CFBundleExecutable</key>       <string>nas-mount</string>
+      <key>CFBundleIconFile</key>         <string>nas-mount</string>
+      <key>CFBundlePackageType</key>      <string>APPL</string>
+      <key>CFBundleShortVersionString</key> <string>0.1.0</string>
+      <key>CFBundleVersion</key>          <string>0.1.0</string>
+      <key>LSMinimumSystemVersion</key>   <string>13.0</string>
+      <!-- Background-only: never shows a Dock tile or menu bar. -->
+      <key>LSUIElement</key>              <true/>
+    </dict>
+    </plist>
+    EOF
+    runHook postInstall
+  '';
+
+  # Ad-hoc sign the *bundle*. Not optional: rustc's linker ad-hoc signs the
+  # standalone Mach-O, but that signature has no sealed Info.plist or
+  # _CodeSignature/, so the enclosing .app is an invalid code object
+  # ("code has no resources but signature indicates they must be present")
+  # and launchd refuses to spawn it — `last exit code = 78: EX_CONFIG`, with
+  # nothing in the job's own log because it never runs. A real Developer ID
+  # signature can be layered on top later (scripts/sign-launchd-agents.ts);
+  # this just guarantees the bundle is valid on any machine, cert or no cert.
+  #
+  # postFixup, not postInstall: fixupPhase strips binaries, which would
+  # invalidate a signature applied during install.
+  postFixup = ''
+    rcodesign sign $out/Applications/NasMount.app
+  '';
+
+  meta = {
+    description = "Mounts the UNAS Pro 4 Personal-Drive SMB share if not already mounted";
+    mainProgram = "nas-mount";
+    platforms = [
+      "aarch64-darwin"
+      "x86_64-darwin"
+    ];
+  };
+}
diff --git a/scripts/sign-launchd-agents.ts b/scripts/sign-launchd-agents.ts
new file mode 100755
index 00000000..186c0da6
--- /dev/null
+++ b/scripts/sign-launchd-agents.ts
@@ -0,0 +1,244 @@
+#!/usr/bin/env bun
+// Interactive fzf-based signer for ~/Library/LaunchAgents executables.
+//
+// Lists every user LaunchAgent with its current signature status
+// (unsigned / ad-hoc / Apple-signed-no-team / Developer ID), identity, and
+// signed time; lets you multi-select which to (re-)sign; signs the whole
+// batch with one passphrase entry via rcodesign against a .p12 you supply
+// (never touches macOS codesign/Keychain ACLs directly — see
+// docs/unifi-dream-machine.md and knowledge/decisions/nas-mount-codesigning.md
+// for why: root-run activation scripts can't reach the login keychain's
+// private key, and committing the key via sops would permanently widen
+// exposure of a real Apple Developer ID for a cosmetic Login Items label).
+// rcodesign is deliberate, not incidental: unlike plain `codesign`, it never
+// touches the Keychain/session ACL at all, which is exactly what will let
+// this same approach run non-interactively in CI later (certs stored
+// there securely) — plain `codesign` could never do that. It only signs
+// Mach-O/bundle/DMG/pkg though, not plain scripts — see
+// pkgs/nas-mount/package.nix for why nas-mount is a compiled binary now.
+//
+// You export the .p12 yourself, via Keychain Access.app, selecting only the
+// ONE identity you want (right-click > Export Items...) — NOT via `security
+// export -t identities`, which sweeps up every identity in the keychain
+// indiscriminately (confirmed 2026-07-09: it bundled an unrelated "Apple
+// Development" cert from Xcode alongside "Developer ID Application", and
+// rcodesign silently signed with the wrong one instead of erroring — no
+// `security export` flag filters by specific item, this is a documented
+// CLI limitation, not something scriptable around).
+//
+// Run this yourself, interactively — never through an automated session.
+// The passphrase never leaves this process (temp file only, mode 0700 dir,
+// deleted on exit); the .p12 itself is yours to manage/delete afterward.
+
+import { accessSync, constants as fsConstants, existsSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const HOME = process.env.HOME ?? "";
+const LAUNCH_AGENTS_DIR = join(HOME, "Library/LaunchAgents");
+const TIMESTAMP_URL = "http://timestamp.apple.com/ts01";
+
+type SignStatus = "unsigned" | "adhoc" | "signed-no-team" | "developer-id" | "unresolved";
+
+interface AgentInfo {
+  label: string;
+  plistPath: string;
+  execPath: string | null;
+  writable: boolean;
+  status: SignStatus;
+  authority: string | null;
+  teamId: string | null;
+  signedTime: string | null;
+}
+
+function run(cmd: string[]): { stdout: string; stderr: string; exitCode: number } {
+  const proc = Bun.spawnSync({ cmd, stdout: "pipe", stderr: "pipe" });
+  return {
+    stdout: new TextDecoder().decode(proc.stdout ?? new Uint8Array()),
+    stderr: new TextDecoder().decode(proc.stderr ?? new Uint8Array()),
+    exitCode: proc.exitCode ?? 1,
+  };
+}
+
+function isWritable(path: string): boolean {
+  try {
+    accessSync(path, fsConstants.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// When a plist's executable lives inside a .app, sign (and inspect) the whole
+// bundle rather than the bare inner Mach-O: the bundle is what Login Items
+// attributes via AssociatedBundleIdentifiers, and codesign seals Info.plist +
+// Resources only at the bundle level. /a/b/Foo.app/Contents/MacOS/foo → /a/b/Foo.app
+function signTarget(execPath: string): string {
+  const i = execPath.indexOf(".app/");
+  return i === -1 ? execPath : execPath.slice(0, i + ".app".length);
+}
+
+function inspectSignature(execPath: string): Pick<AgentInfo, "status" | "authority" | "teamId" | "signedTime"> {
+  const { stdout, stderr } = run(["codesign", "-dv", "--verbose=4", execPath]);
+  const text = stdout + stderr;
+  if (/code object is not signed at all/.test(text)) {
+    return { status: "unsigned", authority: null, teamId: null, signedTime: null };
+  }
+  const authority = text.match(/^Authority=(.+)$/m)?.[1] ?? null;
+  const teamId = text.match(/^TeamIdentifier=(.+)$/m)?.[1] ?? null;
+  const signedTime = text.match(/^Signed Time=(.+)$/m)?.[1] ?? null;
+  const status: SignStatus = teamId && teamId !== "not set" ? "developer-id" : authority ? "signed-no-team" : "adhoc";
+  return { status, authority, teamId, signedTime };
+}
+
+function discoverAgents(): AgentInfo[] {
+  const files = readdirSync(LAUNCH_AGENTS_DIR).filter((f) => f.endsWith(".plist"));
+  const agents: AgentInfo[] = [];
+  for (const f of files) {
+    const plistPath = join(LAUNCH_AGENTS_DIR, f);
+    const { stdout, exitCode } = run(["plutil", "-convert", "json", "-o", "-", plistPath]);
+    let label = f.replace(/\.plist$/, "");
+    let execPath: string | null = null;
+    if (exitCode === 0) {
+      try {
+        const obj = JSON.parse(stdout);
+        if (typeof obj.Label === "string") label = obj.Label;
+        if (typeof obj.Program === "string") execPath = obj.Program;
+        else if (Array.isArray(obj.ProgramArguments) && typeof obj.ProgramArguments[0] === "string") {
+          execPath = obj.ProgramArguments[0];
+        }
+      } catch {
+        // malformed plist JSON — leave execPath null, surfaced as "unresolved"
+      }
+    }
+    if (!execPath) {
+      agents.push({ label, plistPath, execPath: null, writable: false, status: "unresolved", authority: null, teamId: null, signedTime: null });
+      continue;
+    }
+    const target = signTarget(execPath);
+    agents.push({ label, plistPath, execPath: target, writable: isWritable(target), ...inspectSignature(target) });
+  }
+  return agents.sort((a, b) => a.label.localeCompare(b.label));
+}
+
+function statusIcon(s: SignStatus): string {
+  return { "developer-id": "✅", "signed-no-team": "🍎", adhoc: "🔏", unsigned: "❌", unresolved: "❓" }[s];
+}
+
+function formatRow(a: AgentInfo): string {
+  const identity = a.teamId && a.teamId !== "not set" ? `${a.authority} (${a.teamId})` : (a.authority ?? "-");
+  const note = a.execPath?.startsWith("/nix/store/") && !a.writable ? "nix store, read-only" : a.writable ? "" : a.execPath ? "read-only" : "";
+  return [statusIcon(a.status), a.label, identity, a.signedTime ?? "-", a.execPath ?? "?", note].join("\t");
+}
+
+function fzfSelect(lines: string[], opts: string[]): string[] {
+  const proc = Bun.spawnSync({
+    cmd: ["fzf", "--delimiter", "\t", "--with-nth=1,2,3,4,5,6", ...opts],
+    stdin: Buffer.from(lines.join("\n") + "\n"),
+    stdout: "pipe",
+    stderr: "inherit",
+  });
+  const out = new TextDecoder().decode(proc.stdout ?? new Uint8Array()).trim();
+  return out.length ? out.split("\n") : [];
+}
+
+function readSecret(prompt: string): string {
+  // Prompt via /bin/sh's `read -rs` so the terminal handles echo-suppression
+  // natively; only the captured value ever touches this process.
+  const proc = Bun.spawnSync({
+    cmd: ["/bin/sh", "-c", 'read -rs -p "$1" REPLY >&2; printf %s "$REPLY"', "--", prompt],
+    stdin: "inherit",
+    stdout: "pipe",
+    stderr: "inherit",
+  });
+  process.stderr.write("\n");
+  return new TextDecoder().decode(proc.stdout ?? new Uint8Array());
+}
+
+function readLine(prompt: string): string {
+  const proc = Bun.spawnSync({
+    cmd: ["/bin/sh", "-c", 'read -r -p "$1" REPLY >&2; printf %s "$REPLY"', "--", prompt],
+    stdin: "inherit",
+    stdout: "pipe",
+    stderr: "inherit",
+  });
+  return new TextDecoder().decode(proc.stdout ?? new Uint8Array()).trim();
+}
+
+function main() {
+  const agents = discoverAgents();
+  if (agents.length === 0) {
+    console.log(`No LaunchAgents found in ${LAUNCH_AGENTS_DIR}`);
+    return;
+  }
+
+  const selected = fzfSelect(agents.map(formatRow), [
+    "--multi",
+    "--header=TAB/shift-TAB to multi-select, enter to sign, esc to just browse.  ✅ Developer ID  🍎 Apple-signed (no team)  🔏 ad-hoc  ❌ unsigned  ❓ unresolved",
+    "--preview=codesign -dv --verbose=4 {5} 2>&1",
+    "--preview-window=down:12:wrap",
+  ]);
+  if (selected.length === 0) {
+    console.log("Nothing selected.");
+    return;
+  }
+
+  const chosen = selected.map((line) => {
+    const [, label, , , execPath] = line.split("\t");
+    return agents.find((a) => a.label === label && a.execPath === execPath)!;
+  });
+
+  const signable = chosen.filter((a) => a.writable && a.execPath);
+  const skipped = chosen.filter((a) => !a.writable || !a.execPath);
+  if (skipped.length) {
+    console.log("Skipping (not writable in place):");
+    for (const a of skipped) {
+      const reason = a.execPath?.startsWith("/nix/store/") ? "nix store — needs a stable-copy module first (see nas-mount.nix)" : "read-only";
+      console.log(`  - ${a.label}: ${reason}`);
+    }
+  }
+  if (signable.length === 0) {
+    console.log("Nothing left to sign.");
+    return;
+  }
+
+  console.log(`Signing ${signable.length} agent(s): ${signable.map((a) => a.label).join(", ")}`);
+  console.log("Export the ONE identity you want (e.g. \"Developer ID Application: ...\") from Keychain Access.app first:");
+  console.log("  right-click it in the login keychain > Export Items... > save as a .p12");
+  console.log("(security export -t identities would bundle every identity in the keychain — not what you want here.)");
+  const p12 = readLine("Path to that .p12 file: ");
+  if (!existsSync(p12)) {
+    console.error(`No file at ${p12}. Aborting.`);
+    process.exitCode = 1;
+    return;
+  }
+
+  const tmp = mkdtempSync(join(tmpdir(), "sign-launchd-"));
+  const cleanup = () => rmSync(tmp, { recursive: true, force: true });
+  process.on("exit", cleanup);
+  process.on("SIGINT", () => {
+    cleanup();
+    process.exit(130);
+  });
+
+  try {
+    const password = readSecret("p12 passphrase: ");
+    const passFile = join(tmp, "pass");
+    writeFileSync(passFile, password, { mode: 0o600 });
+
+    for (const a of signable) {
+      const sign = run(["rcodesign", "sign", "--p12-file", p12, "--p12-password-file", passFile, "--timestamp-url", TIMESTAMP_URL, a.execPath!]);
+      if (sign.exitCode !== 0) {
+        console.error(`✗ ${a.label}: ${sign.stderr.trim() || sign.stdout.trim()}`);
+        continue;
+      }
+      const after = inspectSignature(a.execPath!);
+      console.log(`✓ ${a.label}: ${after.authority ?? "signed"}${after.signedTime ? ` (${after.signedTime})` : ""}`);
+    }
+  } finally {
+    cleanup();
+  }
+  console.log(`Done. That .p12 (${p12}) is yours to delete now if you don't need it anymore.`);
+}
+
+main();