同印方载，异印即拒 · Accept host-matched re-signed macOS artifacts

[zerob13]

Summary

@arcships/light-ocr-darwin-* native packages are re-signed by downstream macOS packaging pipelines: osx-sign rewrites the LC_CODE_SIGNATURE blob of every Mach-O under Contents with --force (including light_ocr_node.node and libonnxruntime.1.22.0.dylib), changing both file size and sha256. The runtime descriptor's strict bytes+sha256 gate then rejects intact binaries with package_load_failed: Descriptor artifact byte count mismatch.

What changed (packages/runtime/src/load-native.cjs):

• The descriptor check stays the primary gate: stats.size === bytes and sha256(file) === sha256 → load (unchanged path).
• On macOS only, when the size or hash diverges, a Mach-O is accepted as an equivalent integrity proof iff:
  1. it is a Mach-O (magic pre-check),
  2. codesign --verify --strict passes,
  3. its signing identity matches the host process (process.execPath): identical TeamIdentifier, or both sides ad-hoc signed.
• Everything else keeps the existing error contract (package_load_failed, byte count / hash mismatch) — no silent fallback, no partial state.
• win32/linux keep the strict gate (payloads are never re-signed there). The native directory inventory check and the post-load validateNativeContract() ABI check are unchanged.
• Malformed descriptor records (non-integer bytes, non-hex sha256) still fail hard; the relaxation never applies to them.

Security boundary: ad-hoc signatures are reproducible by anyone, so the both-ad-hoc branch is a documented, macOS-only relaxation. The host-match rule rejects payloads re-signed by any other identity.

Electron integration (no config required)

Nothing changes for Electron apps — the loader auto-adapts to the host signature:

Host app signature	Package state	Result
Your Developer ID (notarized app, e.g. electron-builder + osx-sign)	Re-signed by the same Developer ID during packaging	✅ loads
Ad-hoc (dev build / unsigned local app)	Re-signed ad-hoc (or untouched)	✅ loads
Any team ≠ host team	Re-signed by a different vendor	❌ package_load_failed (by design)
Untouched npm package (any host)	Descriptor matches	✅ loads (strict path, no codesign involved)

• electron-builder / osx-sign re-signing node_modules/@arcships/light-ocr-darwin-*/native/*.node and *.dylib with your Developer ID now loads instead of failing.
• No env flag, no configuration, no extra dependency: codesign is a stock macOS binary and the loader only verifies (no keychain, no certificate required).
• If packaging re-signs the native payload with an identity different from the app's own executable, the load fails closed — re-sign it with the same identity as the app bundle.

Verification

• bindings/node/test/signed-artifact.test.cjs: policy matrix (all platforms) + macOS integration with real codesign (pristine accept; unsigned mutation reject on the size and hash branches; ad-hoc re-sign accepted when the host is ad-hoc, rejected when the host is Developer ID signed; non-Mach-O mutation reject; Developer ID round-trip self-skips when a keychain identity is unavailable — the suite never hangs on a keychain prompt).
• Manual run on a Developer ID signed host (TeamIdentifier 3AA79YWT4C): pristine pass; tampered-unsigned rejected; ad-hoc re-sign rejected (different signer).
• Existing descriptor / WebGPU / runtime tests unchanged and passing; python release-contract suite 83/83.
• Versions advanced conservatively to 0.5.7 (runtime 0.1.7, tiny/medium 0.1.6, document 0.1.3); CHANGELOG.md, README (EN/ZH), npm package README, and decision record D117 updated.

Checklist

• The change is focused; relevant tests were added or updated when behavior changed.
• Documentation and CHANGELOG.md were updated for user-visible changes.
• No credentials, private OCR inputs, generated build trees, or unrelated artifacts are included.