Apple Silicon Metal sidecar needs protected v0.15 acceptance replay

[jondo2010]

Parent: #884
Release target: v0.15.0

Outcome

The Apple Silicon implementation is now verified locally on the current dev/codestory-next head. This issue remains open only for the protected exact-candidate replay and installed v0.15.0 readback.

The original v0.13.12 report covered three failures: managed llama-server extraction, unverified Metal observation, and loss of the native embedding endpoint after repair. The current implementation fixes those failure modes and fails closed if the live endpoint or process identity no longer matches the persisted runtime.

Current-dev evidence

Local proof used the packaged macOS arm64 CLI built from f2333443f8720190708bc5309439f8bf11e94a6e on an Apple M5 host with an isolated cache.

• CLI: codestory-cli 0.14.3; package SHA-256 b1652e3fad10543ad5af928061dc53d9fe8db88f9c136b2d1257c4205057859b
• Model SHA-256: ad1afe72cd6654a558667a3db10878b049a75bfd72912e1dabb91310d671173c
• Managed native Metal launch: native_spawned, 13/13 layers offloaded, retrieval_mode=full, gpu_proof=verified, 7 ms embedding smoke
• Repair-worker exit followed by MCP/plugin restart reused PID 43113 with the same process-start identity; packet and search remained allowed
• Killing the endpoint changed readiness to repair_retrieval, marked the resource stale, downgraded GPU proof to gpu_unverified, and blocked agent retrieval despite the persisted full manifest
• Repair recovered full verified Metal on a new PID, then returned 10 indexed search hits and a sufficient packet with no gaps
• Proof-owned processes, ports, temporary caches, and models were cleaned after the run

The retained evidence bundle is recorded as macos-metal-f233344-20260714T040904Z; bundle archive SHA-256 is b3fa6cb5e5f7c74857a0b5f1d9099993ecceb30f8be1c3bf290cf52e98b87639.

Delivered implementation

• Make macOS a release-gated supported platform #1048 added the macOS runtime, dynamic endpoint, process identity, and fail-closed readiness work.
• [codex] prove grounding-only managed plugin convergence #1058 added the packaged Apple Silicon lifecycle and restart/death/recovery proof path.
• migrate sidecar identity to v3 #1059 completed the cross-platform native-process identity contract.

Acceptance checklist

Implementation and local hardware proof

• Resolve and checksum the managed macOS arm64 llama-server and embedding model.
• Launch managed Metal on Apple Silicon and verify real GPU offload.
• Reach retrieval_mode=full with gpu_proof=verified and allow packet/search.
• Reuse the same live native process after the repair worker exits and MCP restarts.
• Detect endpoint death, return repair_retrieval, and block packet/search without trusting the persisted full manifest.
• Repair the dead runtime and recover verified Metal, successful search, and a sufficient packet.
• Clean all proof-owned processes, ports, caches, and models.

Remaining release acceptance

• Run the protected Apple Silicon workflow once on the exact final integration candidate and retain the hosted status, logs, packet, search, and cleanup artifacts.
• Install the published v0.15.0 plugin/CLI through the real Codex marketplace path and read back the installed version and digest, then repeat the live restart, search, and packet checks.

Evidence boundary

The earlier protected run 29288159984 failed before CodeStory started because both pinned model downloads returned HTTP 403. It is useful infrastructure evidence, but it is not counted as product acceptance.

Signing, notarization, Gatekeeper, Intel qualification, and marketplace publication remain tracked by #1046. Do not close this issue until both unchecked release items above pass on the candidate that will ship.

[TheGreenCedar]

Thank you for the detailed issue again @jondo2010 ! I'll get to it as soon as I can. Currently refactoring this layer in #886 for better maintainability, and I will include the mac fixes in the PR.