macOS: auto-update always fails — app bundled adhoc-signed (no Developer ID / notarization)

macOS auto-update always fails — app bundled ADHOC-signed (no Developer ID, not notarized)

Bug: In-app auto-update (v3.0.18 → v3.0.20) downloads the new build, then fails code-signature validation. ShipIt cleans up the package and report shows:

Code signature at file:///.../com.claudecoderouter.desktop.ShipIt/update.XXXX/Claude Code Router.app/
did not pass validation: 代码未能满足指定的代码要求 (code failed to satisfy the specified code requirement)

Root cause: electron-updater/Squirrel.Mac verifies the downloaded update against the currently installed app's Designated Requirement. A bundle signed adhoc has a DR pinned to the exact cdhash of that build — any newer build has a different cdhash, so validation always fails. This is by design, not a one-off.

Evidence — both the shipped 3.0.18 (as installed) and the 3.0.20 release zip are adhoc-signed, unsigned, unnotarized:

$ codesign -dv --verbose=4 "Claude Code Router.app"
Identifier=com.claudecoderouter.desktop
CodeDirectory flags=0x10002(adhoc,runtime)
Signature=adhoc
TeamIdentifier=not set

$ spctl -a -vv "Claude Code Router.app"
Claude Code Router.app: rejected

Impact:

1. Auto-update permanently broken for every mac user (manual reinstall required per release).
2. Gatekeeper rejects the app when downloaded normally (right-click-open or quarantine-removal needed).

Fix request: sign mac bundles with a real Developer ID Application certificate and notarize them (.zip/.dmg + stapler or notarytool). After that the DR uses anchor apple generic, future updates validate, and Gatekeeper is satisfied. CI: electron-builder with mac.notarize + identity: "Developer ID Application: ..." handles both.

Repro: run app → trigger "check for updates" from any installed build where a newer release exists.