# macOS Notification Access Preparation

Last verified: 2026-06-02

Read this when you need to provide macOS runner/signing access so an agent can
finish macOS notification implementation and smoke verification. You do not need
to run the test from this document.

## Provide

| Needed | What to prepare |
|---|---|
| macOS runner | Local Mac, remote Mac, or a decision that visible smoke is deferred. |
| Operator path | Who handles UI prompts if the runner is remote. |
| Signing mode | Local ad hoc, Apple Developer signing, or distribution/notarization path. |
| Bundle ID | Required if signing beyond ad hoc is needed. |
| Apple access | Team/provisioning access if notification entitlement or APNs is in scope. |
| Push scope | Decide local notification only, APNs/Firebase-backed smoke, or deferred push. |
| Evidence path | Choose where sanitized logs/screenshots/run notes should be stored. |

## Do Not Put In Tracked Files

- Team ID, signing identity, provisioning profile, notarization profile, Apple
  ID, APNs/Firebase secrets, device token, private endpoint, auth token, channel
  name, user name, or server URL.

## Agent Can Then

- configure the macOS host app for the selected signing mode;
- implement or verify the native notification/action bridge;
- run local routing checks and, if allowed, visible notification smoke;
- record sanitized evidence in the task or private run note.

## Current Repo Note

The macOS plugin is still a scaffold. It currently has only the legacy
`nexo_messaging` channel, so visible notification smoke also needs bridge
implementation work.