[wieslawsoltes]

Problem

A release bundle can contain application-supplied .node or .dylib files whose LC_ID_DYLIB still names the producer's absolute build path. The recursive macOS audit correctly rejects that path, but the SDK packager previously relocated only WebScene's own framework identity. The exact Code OSS package stopped on three Copilot native modules under /Users/runner/work/... before signing.

Result

The package step now scans the same bounded, symlink-safe Mach-O inventory before architecture normalization and rewrites only non-system absolute identities to @rpath/<basename>. It keeps absolute dependencies and rpaths fail-closed, rejects inconsistent identities across universal slices, and records the original/result identity and hashes in schema-validated normalization evidence.

Closes #410.

Validation

• Portable/adversarial macOS audit contract: 24/24.
• Installed macOS SDK contract: universal .node thinned, absolute-identity dylib relocated, bundle signed, both extensions loaded with dlopen, four Mach-O files, ten deterministic audits in 2.417 s, 3,185-byte evidence.
• Exact Code OSS failed bundle: 21-second package pass over 21,007 entries / 27 Mach-O files; all three native modules normalized and Node 24.18.1 loaded all three successfully.
• Exact normalization evidence records three relocations, stable arm64 architecture closure and zero unresolved dependencies; deep strict code-sign verification passes.
• Idempotent exact-bundle scan: three passes in 8.24 s total, 57.7 MiB maximum RSS and zero writes.
• Python syntax, JSON syntax and diff checks pass.