Normalize universal Mach-O inputs before single-architecture package audit #344

Problem

PR #343 / #328 correctly made the installed WebScene SDK recursively audit every final-bundle Mach-O against the requested architecture set before outer signing. The first exact Code OSS package audit exposed a pre-existing input that now fails that contract:

Contents/Resources/server/node_modules/kerberos/build/Release/kerberos.node
architectures: x86_64 arm64
requested package: arm64

The package runs the arm64 slice, but retains an unused x86_64 slice. The current WebScene package_macos.py audits before AppScene package-policy transforms, so downstream symbol stripping cannot make the final bundle single-architecture. The historical vscode-demo direct packager already has an atomic lipo -thin arm64 workaround; reusable SDK packaging must own this behavior.

Exact reproduction inputs:

• AppScene f52fb46b2fc494b78520f7102ae960606ab618cb
• WebScene 348ea440501c4059da6f95d1fbd6f6159a5df47b package, followed by Add recursive final-bundle Mach-O audit #343 audit behavior
• Code OSS 645f29cc3176500b4b5762ba887cf2a7f0ffdf2c
• package: dist/appscene-release-348ea440-f52fb46b/Code OSS AppScene.app
• all other 21 Mach-O images are arm64; zero forbidden WebKit/Electron/Chromium/CEF dependencies; deep signature and native module load checks pass

Proposed WebScene SDK fix

Before recursive audit and signing, normalize every regular final-bundle Mach-O to the explicitly requested single architecture:

1. enumerate with the same safe inventory used by Add recursive final-bundle Mach-O audit #343;
2. leave exact-architecture files byte/mtime stable;
3. reject files without the requested slice;
4. run lipo -thin into a same-directory private temporary file;
5. validate Mach-O type, resulting exact architecture, deployment target, mode, ownership assumptions, and dependency/install-name/rpath closure;
6. atomically replace the original;
7. never follow or replace symlinks, escape the bundle, or leave partial/temp files;
8. record original/result bytes and SHA-256 in bounded deterministic audit evidence;
9. sign only after every transform and full recursive audit succeed.

The transform should activate only for an explicitly single-architecture package. Multi-architecture publication must retain and audit every requested slice.

Acceptance gates

• thin/universal/wrong-architecture/fat64 fixtures, native extensions, dylibs and executables;
• symlink, hardlink, case/Unicode collision, mutation, special-file, mode, read-only, interrupted-lipo, malformed-output, and missing-slice negatives;
• unchanged exact-architecture idempotence and stable mtimes;
• 10,000-entry time, FD, peak temporary disk, RSS, evidence-size, and cleanup bounds;
• real installed-SDK macOS consumer containing a universal .node, followed by load/sign/audit;
• exact Code OSS package passes Add recursive final-bundle Mach-O audit #343 recursive audit as arm64-only and kerberos still loads through packaged Node;
• no Code OSS paths or product-specific allowlists in WebScene.