[iFurySt]

Problem

Normal screen unlock evaluates the Locked Use remote branch before native authentication. On a cold authorization-host load, Gatekeeper can wait for an online notarization-ticket lookup before mechanismInvoke starts. Local traces showed about 6.24 seconds before invocation, while the mechanism itself returned in about 11 ms. Non-locking remote-right requests reproduced approximately 3.17 s / 8.5 ms and 3.40 s / 10.1 ms cold/warm pairs.

The release workflow only stapled the outer App. The separately installed authorization bundle had no stapled ticket, and npm packages were already staged and packed before notarization. Stapling the nested payload afterward also changes the outer App's resource seal.

Change

• Notarize the installable payload first, staple and validate the authorization bundle and Guardian, then re-sign the outer App with preserved signing metadata before its final notarization/stapling.
• Restage and repack npm and direct-download artifacts from the final App without rebuilding the native binaries.
• Add a non-locking four-sample latency diagnostic, installed-rule preflight, focused regression tests, and a dedicated test-only PR/main workflow named locked-use-distribution-tests. Cover staging/archive scripts and their inputs in path triggers. Document the investigation and concrete artifact, installation and cold/warm unlock acceptance procedure.

Validation

• Eight focused tests pass: diagnostic stop conditions, notarization ordering/failure handling, real repository staging and archive scripts preserving all three ticket files across all npm aliases and the direct-download App ZIP, manifest integrity, and rejection of missing prebuilt runtimes. Apple-only inspection/archive tools remain simulated in this portable suite.
• Signing-keychain restoration regression, shell syntax, YAML parsing, make check-docs, Action SHA pinning, and git diff --check pass.
• Updated Swift probe compiles; earlier real requests confirmed the plugin's invocation and expected Deny markers without locking the desktop.
• Real scratch copies confirmed child stapling succeeds, invalidates the outer resource seal, and outer re-signing repairs strict signature verification.

Remaining verification

This fixes the identified ticket-distribution gaps. It does not yet prove that all cold-load latency is eliminated: security caches and other trust/network checks can still affect timing. A real Developer ID/notarization build, installation round trip, and cold/warm manual-unlock comparison remain pending. No installed system component or authentication policy was changed during this investigation.

Evidence and reproduction: cold-authorization investigation.