diff --git a/.github/workflows/npm-release.yml b/.github/workflows/npm-release.yml
index 3cf32d8..8df1088 100644
--- a/.github/workflows/npm-release.yml
+++ b/.github/workflows/npm-release.yml
@@ -6,7 +6,7 @@ on:
       version:
         description: Core and stable Small facade version
         required: true
-        default: 0.5.6
+        default: 0.5.7
         type: string
       publish_to_registry:
         description: Publish the tested candidate to npm under next
@@ -283,7 +283,7 @@ jobs:
           npm install --offline --ignore-scripts --no-audit --no-fund --package-lock=false \
             ../dist/release/arcships-light-ocr-model-ppocrv6-small-0.3.4.tgz \
             ../dist/release/arcships-light-ocr-${{ matrix.native }}-${RELEASE_VERSION}.tgz \
-            ../dist/release/arcships-light-ocr-runtime-0.1.6.tgz \
+            ../dist/release/arcships-light-ocr-runtime-0.1.7.tgz \
             ../dist/release/arcships-light-ocr-${RELEASE_VERSION}.tgz
           cp ../tools/npm/smoke.cjs .
       - name: Run stable Small OCR
@@ -296,6 +296,17 @@ jobs:
         shell: bash
         working-directory: package-smoke
         run: node ../tools/npm/document-smoke.cjs
+      - name: Validate macOS signed-artifact policy with the default host
+        if: runner.os == 'macOS'
+        run: node --test bindings/node/test/signed-artifact.test.cjs
+      - name: Validate macOS signed-artifact policy with an ad-hoc host
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          adhoc_node="$RUNNER_TEMP/light-ocr-adhoc-node"
+          cp "$(command -v node)" "$adhoc_node"
+          codesign --force --sign - "$adhoc_node"
+          "$adhoc_node" --test bindings/node/test/signed-artifact.test.cjs
       - name: Install and smoke preview tiers
         if: matrix.preview
         shell: bash
@@ -306,8 +317,8 @@ jobs:
           npm install --offline --ignore-scripts --no-audit --no-fund --package-lock=false \
             ../dist/release/arcships-light-ocr-model-ppocrv6-tiny-0.1.0.tgz \
             ../dist/release/arcships-light-ocr-model-ppocrv6-medium-0.1.0.tgz \
-            ../dist/release/arcships-light-ocr-tiny-0.1.5.tgz \
-            ../dist/release/arcships-light-ocr-medium-0.1.5.tgz
+            ../dist/release/arcships-light-ocr-tiny-0.1.6.tgz \
+            ../dist/release/arcships-light-ocr-medium-0.1.6.tgz
           node ../tools/npm/smoke-tier.cjs @arcships/light-ocr-tiny light-ocr-tiny \
             ppocrv6-tiny-onnx-20260722.1
           node ../tools/npm/smoke-tier.cjs @arcships/light-ocr-medium light-ocr-medium \
@@ -362,7 +373,7 @@ jobs:
           cd registry-document
           npm init --yes
           npm install --ignore-scripts --no-audit --no-fund --package-lock=false \
-            "@arcships/light-ocr-document@0.1.2"
+            "@arcships/light-ocr-document@0.1.3"
           node ../tools/npm/document-smoke.cjs
       - name: Verify the published stable package offline
         shell: bash
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3003751..4957e7b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,21 @@ This file records user-visible changes to `light-ocr`. Published artifact detail
 
 ## [Unreleased]
 
+### Fixed
+
+- On macOS only, accepted a re-signed native payload as an equivalent
+  integrity proof when its runtime descriptor size/SHA-256 check diverges.
+  Downstream macOS packagers (for example app notarization pipelines) may
+  re-sign `light_ocr_node.node` and the ONNX Runtime dylib with their own
+  Developer ID or ad-hoc identity, which rewrites the code signature and
+  changes both file size and SHA-256. The re-signature is trusted only when
+  `codesign --verify --strict` passes and the artifact's TeamIdentifier
+  equals the host process's, or when both sides are ad-hoc signed; unsigned
+  mutations, non-Mach-O artifacts, and every other platform keep the strict
+  descriptor gate and the `package_load_failed` contract. The ad-hoc
+  acceptance is deliberately macOS-only and documented because ad-hoc
+  signatures are reproducible by anyone.
+
 ## [0.5.6] - 2026-07-31
 
 ### Changed
diff --git a/README.md b/README.md
index d1bf7a6..b6efa9e 100644
--- a/README.md
+++ b/README.md
@@ -152,6 +152,8 @@ for await (const page of recognizeDocument([buf1, buf2, buf3])) {
 - **Application-friendly execution.** Recognition runs off the JavaScript main thread and supports queues, cancellation, and explicit cleanup.
 - **Small text in large images.** An optional `tiled` mode preserves small and dense text in high-resolution images.
 
+> **macOS re-signing.** Downstream macOS packagers may re-sign the native binaries with their own Developer ID (or ad-hoc) identity, for example when notarizing a distributed app. On macOS the loader accepts a re-signed Mach-O when its code signature verifies and its signing identity matches the host application (same TeamIdentifier, or both ad-hoc signed); other platforms and unsigned mutations keep the strict size + SHA-256 gate.
+
 > ⭐ **Like light-ocr?** Give it a star — it helps others discover the project and keeps us motivated!
 
 ## Platform acceleration
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 4d5ff53..84fea06 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -145,6 +145,8 @@ for await (const page of recognizeDocument([buf1, buf2, buf3])) {
 - **适合应用内调用。**识别任务在 JavaScript 主线程之外执行，并支持队列、取消和明确释放资源。
 - **识别大图中的小字。**可选的 `tiled` 模式可以保留高分辨率图片中的小字和密集文字。
 
+> **macOS 重新签名。**下游 macOS 打包方可以用自己的 Developer ID（或 ad-hoc）身份重新签名原生二进制，例如在公证分发的应用时。加载器在 macOS 上接受重新签名过的 Mach-O，前提是其代码签名校验通过且签名身份与宿主应用一致（TeamIdentifier 相同，或双方均为 ad-hoc 签名）；其他平台与未经签名的篡改仍保持严格的字节数 + SHA-256 校验。
+
 > ⭐ **觉得 light-ocr 有用？** 点个 Star，让更多人发现这个项目！
 
 ## 平台加速
diff --git a/VERSION b/VERSION
index b49b253..d3532a1 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.5.6
+0.5.7
diff --git a/bindings/node/test/cli.test.cjs b/bindings/node/test/cli.test.cjs
index 7537c82..c438bb2 100644
--- a/bindings/node/test/cli.test.cjs
+++ b/bindings/node/test/cli.test.cjs
@@ -108,7 +108,7 @@ test('info: --version is metadata-only and reports the Small tier', async () =>
   assert.equal(code, EXIT.success);
   assert.equal(stderr, '');
   const info = JSON.parse(stdout);
-  assert.equal(info.core, '0.5.6');
+  assert.equal(info.core, '0.5.7');
   assert.equal(info.tier, 'small');
   assert.equal(info.maturity, 'stable');
   assert.equal(info.model, 'ppocrv6-small-native-20260719.1');
diff --git a/bindings/node/test/signed-artifact.test.cjs b/bindings/node/test/signed-artifact.test.cjs
new file mode 100644
index 0000000..26b0691
--- /dev/null
+++ b/bindings/node/test/signed-artifact.test.cjs
@@ -0,0 +1,306 @@
+'use strict';
+
+// Coverage for the macOS-only signed-artifact relaxation in
+// packages/runtime/src/load-native.cjs: a Mach-O whose bytes/sha256 differ
+// from the runtime descriptor is accepted on darwin when its code signature
+// verifies and its signing identity matches the host process (same
+// TeamIdentifier, or both ad-hoc). All other platforms keep the strict
+// bytes+sha256 gate, and unsigned mutations are always rejected.
+//
+// The release gate runs this suite once with the default Node host and once
+// with an ad-hoc re-signed Node copy, so both the different-identity rejection
+// and mutual ad-hoc acceptance paths execute on macOS. The real Developer ID
+// round-trip (same team as the host) additionally runs when a matching
+// code-signing identity is available in the keychain and usable without an
+// interactive prompt; otherwise that one case self-skips and remains manual
+// release evidence.
+
+const assert = require('node:assert/strict');
+const { spawnSync } = require('node:child_process');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const test = require('node:test');
+
+const { validateRuntimeDescriptor, macOSSignature } = require(
+  '../../../packages/runtime/src/load-native.cjs',
+);
+
+const onDarwin = process.platform === 'darwin';
+
+function run(command, args, options) {
+  const result = spawnSync(command, args, { encoding: 'utf8', ...options });
+  return { status: result.status, stdout: result.stdout, stderr: result.stderr, error: result.error };
+}
+
+function codesign(args, options) {
+  return run('codesign', args, options);
+}
+
+function signAdHoc(filename) {
+  return codesign(['--force', '-s', '-', filename]).status === 0;
+}
+
+function flipByte(filename, offset) {
+  const bytes = fs.readFileSync(filename);
+  bytes[offset] ^= 0xff;
+  fs.writeFileSync(filename, bytes);
+}
+
+function appendByte(filename) {
+  const bytes = fs.readFileSync(filename);
+  fs.writeFileSync(filename, Buffer.concat([bytes, Buffer.from([0x00])]));
+}
+
+function assertPackageLoadFailed(callback, messagePart) {
+  assert.throws(
+    callback,
+    (error) => (
+      error.name === 'OcrError' &&
+      error.code === 'package_load_failed' &&
+      (messagePart === undefined || error.message.includes(messagePart))
+    ),
+  );
+}
+
+// Stages a minimal macos native/ payload whose addon and runtime are real
+// Mach-O copies (universal /bin/ls), with a matching runtime descriptor.
+function stagePackage() {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'light-ocr-signed-'));
+  const native = path.join(directory, 'native');
+  fs.mkdirSync(native);
+  const addon = path.join(native, 'light_ocr_node.node');
+  const runtime = path.join(native, 'libonnxruntime.1.22.0.dylib');
+  fs.copyFileSync('/bin/ls', addon);
+  fs.copyFileSync('/bin/ls', runtime);
+  const record = (filename) => ({
+    path: path.relative(directory, filename).replaceAll(path.sep, '/'),
+    bytes: fs.statSync(filename).size,
+    sha256: crypto.createHash('sha256').update(fs.readFileSync(filename)).digest('hex'),
+  });
+  const platformId = `macos-${process.arch}`;
+  const machine = process.arch === 'arm64' ? 'arm64' : 'x86_64';
+  const appleSupported = process.arch === 'arm64';
+  const descriptor = {
+    schemaVersion: '2.0',
+    platform: { id: platformId, os: 'darwin', architecture: machine },
+    runtime: {
+      flavor: 'cpu',
+      kind: 'onnxruntime-cpu',
+      version: '1.22.0',
+      abi: 'onnxruntime-c-api-22',
+      artifacts: [record(runtime)],
+    },
+    qualificationOnly: false,
+    released: true,
+    autoPolicy: {
+      id: `${platformId}-v1`,
+      version: 1,
+      providers: appleSupported ? ['apple', 'cpu'] : ['cpu'],
+    },
+    providers: {
+      cpu: {
+        runtimeProvider: 'CPUExecutionProvider',
+        qualificationId: 'cpu-baseline-v1',
+        artifacts: [record(runtime)],
+      },
+      ...(appleSupported
+        ? {
+            apple: {
+              runtimeProvider: 'CoreML',
+              qualificationId: 'apple-open-macos-v1',
+              artifacts: [record(addon)],
+            },
+          }
+        : {}),
+    },
+    addon: record(addon),
+  };
+  const descriptorPath = path.join(native, 'runtime-descriptor.json');
+  fs.writeFileSync(descriptorPath, `${JSON.stringify(descriptor)}\n`);
+  return { directory, addon, runtime, descriptorPath };
+}
+
+test('signerMatchesHost accepts only identical teams or mutual ad-hoc', () => {
+  const teamA = { teamIdentifier: 'AAAAAAAAAA', adhoc: false };
+  const teamB = { teamIdentifier: 'BBBBBBBBBB', adhoc: false };
+  const adhoc = { teamIdentifier: null, adhoc: true };
+  assert.equal(macOSSignature.signerMatchesHost(teamA, teamA), true);
+  assert.equal(macOSSignature.signerMatchesHost(teamB, teamB), true);
+  assert.equal(macOSSignature.signerMatchesHost(adhoc, adhoc), true);
+  assert.equal(macOSSignature.signerMatchesHost(teamA, teamB), false);
+  assert.equal(macOSSignature.signerMatchesHost(teamA, adhoc), false);
+  assert.equal(macOSSignature.signerMatchesHost(adhoc, teamA), false);
+  assert.equal(macOSSignature.signerMatchesHost(null, teamA), false);
+  assert.equal(macOSSignature.signerMatchesHost(teamA, null), false);
+  assert.equal(macOSSignature.signerMatchesHost(adhoc, null), false);
+  assert.equal(macOSSignature.signerMatchesHost(null, null), false);
+});
+
+test(
+  'detects Mach-O files and parses codesign identity output',
+  { skip: !onDarwin },
+  () => {
+    const { directory } = stagePackage();
+    try {
+      const macho = path.join(directory, 'native', 'libonnxruntime.1.22.0.dylib');
+      assert.equal(macOSSignature.isMachO(macho), true);
+      const text = path.join(directory, 'text.bin');
+      fs.writeFileSync(text, 'not a mach-o');
+      assert.equal(macOSSignature.isMachO(text), false);
+      assert.equal(signAdHoc(macho), true);
+      assert.equal(macOSSignature.codesignVerifies(macho), true);
+      assert.deepEqual(macOSSignature.codesignIdentity(macho), {
+        teamIdentifier: null,
+        adhoc: true,
+      });
+    } finally {
+      fs.rmSync(directory, { recursive: true, force: true });
+    }
+  },
+);
+
+test(
+  'accepts pristine descriptor artifacts on macOS',
+  { skip: !onDarwin },
+  () => {
+    const { directory, addon, descriptorPath } = stagePackage();
+    try {
+      assert.equal(validateRuntimeDescriptor(descriptorPath).addon, addon);
+    } finally {
+      fs.rmSync(directory, { recursive: true, force: true });
+    }
+  },
+);
+
+test(
+  'rejects a mutated artifact that was not re-signed',
+  { skip: !onDarwin },
+  () => {
+    const { directory, runtime, addon, descriptorPath } = stagePackage();
+    try {
+      appendByte(runtime); // size divergence
+      assertPackageLoadFailed(() => validateRuntimeDescriptor(descriptorPath), 'byte count');
+      flipByte(addon, 0x10); // hash divergence
+      assertPackageLoadFailed(() => validateRuntimeDescriptor(descriptorPath), 'hash');
+    } finally {
+      fs.rmSync(directory, { recursive: true, force: true });
+    }
+  },
+);
+
+test(
+  'rejects a malformed digest before considering the signed-mutation fallback',
+  { skip: !onDarwin },
+  () => {
+    const { directory, addon, runtime, descriptorPath } = stagePackage();
+    try {
+      assert.equal(signAdHoc(runtime), true);
+      const descriptor = JSON.parse(fs.readFileSync(descriptorPath, 'utf8'));
+      descriptor.runtime.artifacts[0].bytes = fs.statSync(runtime).size - 1;
+      descriptor.runtime.artifacts[0].sha256 = 'not-a-sha256-digest';
+      fs.writeFileSync(descriptorPath, `${JSON.stringify(descriptor)}\n`);
+      assertPackageLoadFailed(() => validateRuntimeDescriptor(descriptorPath), 'hash');
+    } finally {
+      fs.rmSync(directory, { recursive: true, force: true });
+    }
+  },
+);
+
+test(
+  'rejects a mutated artifact re-signed ad-hoc by a different identity',
+  { skip: !onDarwin },
+  (t) => {
+    const host = macOSSignature.codesignIdentity(process.execPath);
+    if (host?.adhoc) {
+      t.skip('host process is ad-hoc signed; ad-hoc re-signing is the matching identity');
+      return;
+    }
+    const { directory, runtime, descriptorPath } = stagePackage();
+    try {
+      flipByte(runtime, Math.floor(fs.statSync(runtime).size / 2));
+      assert.equal(signAdHoc(runtime), true);
+      assertPackageLoadFailed(() => validateRuntimeDescriptor(descriptorPath));
+    } finally {
+      fs.rmSync(directory, { recursive: true, force: true });
+    }
+  },
+);
+
+test(
+  'accepts a mutated artifact re-signed ad-hoc when the host is ad-hoc signed',
+  { skip: !onDarwin },
+  (t) => {
+    const host = macOSSignature.codesignIdentity(process.execPath);
+    if (!host?.adhoc) {
+      t.skip('host process is not ad-hoc signed');
+      return;
+    }
+    const { directory, addon, runtime, descriptorPath } = stagePackage();
+    try {
+      flipByte(runtime, Math.floor(fs.statSync(runtime).size / 2));
+      assert.equal(signAdHoc(runtime), true);
+      assert.equal(validateRuntimeDescriptor(descriptorPath).addon, addon);
+    } finally {
+      fs.rmSync(directory, { recursive: true, force: true });
+    }
+  },
+);
+
+test(
+  'rejects a mutated non-Mach-O artifact even when ad-hoc signed',
+  { skip: !onDarwin },
+  () => {
+    const { directory, runtime, descriptorPath } = stagePackage();
+    try {
+      fs.writeFileSync(runtime, 'mutated font-like payload');
+      assert.equal(signAdHoc(runtime), true);
+      assertPackageLoadFailed(() => validateRuntimeDescriptor(descriptorPath));
+    } finally {
+      fs.rmSync(directory, { recursive: true, force: true });
+    }
+  },
+);
+
+test(
+  'accepts a mutated artifact re-signed with the host Developer ID',
+  { skip: !onDarwin },
+  (t) => {
+    const host = macOSSignature.codesignIdentity(process.execPath);
+    if (!host || host.adhoc) {
+      t.skip('host process is not Developer ID signed');
+      return;
+    }
+    const identities = run('security', ['find-identity', '-v', '-p', 'codesigning']);
+    if (identities.status !== 0) {
+      t.skip('security tooling unavailable');
+      return;
+    }
+    const match = identities.stdout.match(
+      new RegExp(`^\\s*\\d+\\)\\s+([0-9A-F]+)\\s+\\"([^\\"]+)\\(${host.teamIdentifier}\\)\\"\\s*$`, 'm'),
+    );
+    if (!match) {
+      t.skip(`no keychain identity for team ${host.teamIdentifier}`);
+      return;
+    }
+    const { directory, addon, runtime, descriptorPath } = stagePackage();
+    try {
+      flipByte(runtime, Math.floor(fs.statSync(runtime).size / 2));
+      // The keychain may require interactive authorization; give codesign a
+      // short budget and self-skip instead of hanging the suite.
+      const signed = codesign(['--force', '-s', match[1], runtime], { timeout: 5000 });
+      if (signed.status !== 0) {
+        t.skip(`Developer ID signing unavailable: ${signed.stderr || signed.error?.message}`);
+        return;
+      }
+      assert.deepEqual(macOSSignature.codesignIdentity(runtime), {
+        teamIdentifier: host.teamIdentifier,
+        adhoc: false,
+      });
+      assert.equal(validateRuntimeDescriptor(descriptorPath).addon, addon);
+    } finally {
+      fs.rmSync(directory, { recursive: true, force: true });
+    }
+  },
+);
diff --git a/docs/build-and-release.md b/docs/build-and-release.md
index f168c81..7812e87 100644
--- a/docs/build-and-release.md
+++ b/docs/build-and-release.md
@@ -1,6 +1,6 @@
 # light-ocr Core 构建与发布
 
-状态：已实现；Core Tier 1 与 npm `0.2.0` 发布证据已产生
+状态：已实现；当前 npm 版本与发布证据见实施状态和 `docs/releases/`
 范围：C++ Core 的依赖锁、构建、测试、验证报告和发布候选制品  
 需求：[requirements.md](requirements.md)  
 当前状态：[implementation-status.md](implementation-status.md)
@@ -223,20 +223,18 @@ PR、main 与 release 使用分层门禁，避免同一提交在三个阶段重
 
 `.github/workflows/npm-release.yml` 是仅允许从 `main` 手动触发的发布候选与发布流程。默认 `publish_to_registry=false`，所以第一次运行不会读取 `NPM_TOKEN` 或改动 npm registry：
 
-- 0.3.0 候选先在 Linux/Python 3.11 的哈希锁工具链中重现并校验内部 WebGPU FP16 派生工件，再在 macOS/Python 3.12 中派生固定 Core ML FP16 package hashes，最后把合并的 native superset bundle 交给 Linux assemble；WebGPU 公共执行 profile 只发布 FP32，用户安装、postinstall 和首次运行都不会执行转换或联网。
-- 六个平台分别原生构建 Node-API addon，并保存许可证与 SPDX SBOM。
-- 汇聚为一个 facade、一个 model 和六个 native packages，执行两次 `npm pack` 并要求 tarball SHA-256 完全一致。
-- 在 macOS arm64/x64、Linux x64 glibc、Linux arm64 glibc、Windows x64、Windows arm64 上使用 Node.js 22 从本地 tarballs 执行 `--ignore-scripts` 安装、CLI 和 CJS/ESM bounded OCR；Node.js 24 的 N-API/loader 兼容性只在 Linux x64 额外验证一次，tiled contract 也只在 Linux x64/Node 22 验证一次。平台无关的 TypeScript declarations 从临时 registry 安装后的 facade 统一编译一次。
-- hash-locked Python oracle 只在实际执行完整 acceptance/oracle 的 Linux x64 release job 安装；其他五个平台不注册或安装不会运行的 live-oracle tests。
-- 八个 tarball 先发布到一次性 Verdaccio registry，只安装 facade 后停止 registry，再执行 CLI 与真实 bounded OCR，证明依赖解析正确且没有运行时下载依赖；tiled contract 已由 exact tarball 矩阵的 Linux x64/Node 22 job 单独覆盖。
-- workflow 在进入六平台构建前先查询 facade 版本；若该版本已经发布，立即失败并要求使用独立 promotion workflow，禁止为改 dist-tag 重建或重发不可变版本。只有 facade 尚未发布时才进入后续昂贵 jobs；依赖包已部分发布、facade 尚未发布的中断场景仍可用同一源码重建并由完整性检查安全续传。
-- 只有以上功能/制品 gates、需要时已经单独完成的受审 baseline，以及 `publish_to_registry=true` 同时满足时，`npm-release` GitHub environment 才能读取 `NPM_TOKEN`；先发布七个依赖到 `next`，确认 facade tarball 能从真实 registry 解析这些依赖后再发布主包，最终保留一次真实 registry 安装后的禁网 OCR。相同 bounded OCR 不在 facade 发布前后重复执行。`latest` 晋升始终由独立 promotion workflow 使用原 release artifact 完成。
+- macOS arm64/x64、Linux x64/arm64 glibc 与 Windows x64/arm64 六个平台分别从锁定输入构建 Node-API addon、ONNX Runtime payload、PDFium addon、许可证清单与 SPDX SBOM。Linux x64 与 Windows x64 使用 production-qualified WebGPU runtime，其余平台使用 CPU runtime。
+- assemble 阶段生成六个 native 包、model-free runtime、Small/Tiny/Medium 三个 facade、Document compatibility facade，以及 Tiny/Medium 两个锁定 model 包，共 13 个 manifest 记录；已发布的 Small model `0.3.4` 另外取得 tarball 参与离线安装验证。
+- 六个平台均使用 Node.js 22 从本地 tarball 执行 `--ignore-scripts --offline` 安装、真实 Small 图片 OCR 与内置 PDF OCR；Linux x64 额外验证 Tiny/Medium preview。macOS 两个平台还以默认 Node 宿主和 ad-hoc 重签的 Node 宿主各运行一次 signed-artifact policy，覆盖不同身份拒绝与双方 ad-hoc 接受。
+- workflow 在进入六平台构建前查询 11 个新版本身份；任何目标版本已存在即失败，要求使用原始 release artifact 做 promotion，禁止重建或覆盖 npm 的不可变版本。Tiny/Medium model `0.1.0` 已存在时仅在 registry integrity 与候选完全一致时复用。
+- `publish_to_registry=true` 时，专用 `npm-release` environment 才读取 `NPM_TOKEN`：先把 native、runtime 与可复用 preview model 阶段发布到 `next`，确认 Small facade tarball 能从真实 registry 解析依赖后，再发布 Small/Tiny/Medium/Document 四个 facade；最后从 registry 回装稳定包并在禁网环境运行图片和 PDF OCR。
+- `latest` 晋升始终由独立 promotion workflow 使用原 release run 保存的 `light-ocr-npm-<version>` artifact 完成，不重新构建或发布 tarball。Tiny、Medium 与 Document 保持在 `next`。
 
-`0.3.0` 发布前 dry-run 的触发命令为：
+任一版本发布前 dry-run 的触发命令为：
 
 ```bash
-gh workflow run "npm release" --ref main \
-  -f version=0.3.0 \
+gh workflow run npm-release.yml --ref main \
+  -f version=<version> \
   -f publish_to_registry=false
 ```
 
@@ -250,7 +248,7 @@ benchmark 结果是独立资格审查证据，不是每次发布的重复步骤
 
 ```bash
 gh workflow run npm-promote.yml --ref main \
-  -f version=0.3.0 \
+  -f version=<version> \
   -f release_run_id=<successful-release-run-id> \
   -f tag=latest
 ```
@@ -289,7 +287,7 @@ bytes: 31334400
 sha256: 74e246bf075c141da51e58515c731298fdabee9fd5bd8feb7cf6c7f4f352de17
 ```
 
-npm release 按 [npm-packaging.md](npm-packaging.md) 生成一个 facade、一个 model 和六个 native staging packages。model package 保存上述归档的精确解包内容；发布候选另外记录八个 npm tarballs 的 bytes、SHA-256、npm integrity 和 registry identity，不能把 Core USTAR hash 当作 npm tarball hash。
+npm release 按 [npm-packaging.md](npm-packaging.md) 生成 13 个受 manifest 管理的 staging packages：六个 native、一个 runtime、Tiny/Medium 两个 model、Small/Tiny/Medium 三个 facade 与一个 Document compatibility facade。已发布的 Small model tarball 另外取得并参与完整闭包安装。`release-manifest.json` 逐包记录 bytes、unpacked bytes、SHA-256、npm shasum、integrity 与 registry identity；不能把 Core USTAR hash 当作 npm tarball hash。
 
 ## 10. 发布候选门槛
 
@@ -298,7 +296,7 @@ npm release 按 [npm-packaging.md](npm-packaging.md) 生成一个 facade、一
 3. 保存 parity、quality、benchmark、leak、Sanitizer、fuzz 和 offline 报告。
 4. 将精确 bundle 文件打入 `@arcships/light-ocr-model-ppocrv6-small`，验证 sterile install，并记录 npm tarball SHA-256/integrity。独立 USTAR mirror 是非 npm 分发项，不阻塞 npm package release。
 5. 为每个平台生成 manifest、许可证清单和 SBOM。
-6. 在隔离环境验证八个 npm tarballs、platform 选择、默认 `createEngine()` 和模型 payload hash；已安装后的运行测试必须禁网。
+6. 在隔离环境验证 13 个 manifest packages、Small model tarball、platform 选择、默认 `createEngine()` 和模型 payload hash；已安装后的运行测试必须禁网。
 7. 对照 [implementation-status.md](implementation-status.md) 关闭所有 Pending 项。
 
-registry 发布由受保护的 `npm-release` environment 执行；workflow 成功记录、registry metadata 与安装复验才构成完成证据。签名、公证、非 npm 公共下载地址和长期保留策略仍是独立的外部事项。
+registry 发布由专用 `npm-release` environment 执行；workflow 成功记录、registry metadata 与安装复验才构成完成证据。仓库可按维护策略为该 environment 增加 required reviewer。签名、公证、非 npm 公共下载地址和长期保留策略仍是独立的外部事项。
diff --git a/docs/decisions.md b/docs/decisions.md
index 68decee..825406a 100644
--- a/docs/decisions.md
+++ b/docs/decisions.md
@@ -422,6 +422,45 @@ Consequence:
   Latin scope. Additional scripts or typography require explicit locked fonts
   and regression fixtures rather than relying on fonts installed on the host.
 
+### D117 — Accept host-matched re-signed Mach-O artifacts on macOS
+
+Status: Accepted and implemented locally<br>
+Authority: D010 offline installation contract, D105 lockstep package set
+
+Decision: The runtime descriptor's bytes + SHA-256 check remains the primary
+integrity gate for every native artifact. On macOS only, when a Mach-O
+artifact's size or hash diverges from the descriptor, the loader accepts the
+file as an equivalent integrity proof if `codesign --verify --strict` passes
+and the artifact's signing identity matches the host process: identical
+TeamIdentifier as `process.execPath`, or both sides ad-hoc signed. Anything
+else fails with the existing `package_load_failed` contract — never a silent
+fallback, never a partial state. The native directory inventory check (the
+referenced artifact set must equal the actual files) and the post-load
+`validateNativeContract()` ABI check stay unchanged. win32/linux keep the
+strict bytes + SHA-256 gate.
+
+Reason: Downstream macOS packaging pipelines re-sign every Mach-O under the
+app bundle (including `light_ocr_node.node` and the ONNX Runtime dylib) with
+a Developer ID or ad-hoc identity while notarizing, rewriting
+LC_CODE_SIGNATURE and changing both file size and SHA-256. The strict gate
+therefore rejected intact, verified binaries. A verified code signature is a
+cryptographic integrity proof over the file content; requiring it to match
+the host identity prevents a different vendor's (or an attacker's) signature
+from laundering an arbitrary replacement payload.
+
+Consequence:
+
+- The same-TeamIdentifier rule lets downstream vendors re-sign with their own
+  Developer ID and keeps the package loadable; the host-match rule rejects
+  payloads signed by any other identity.
+- Ad-hoc signatures are reproducible by anyone, so the both-ad-hoc branch is
+  a documented, macOS-only relaxation. On arm64 macOS the kernel already
+  requires valid (at least ad-hoc) signatures for execution, which bounds the
+  exposure.
+- The relaxation is exercised by automated descriptor tests with ad-hoc
+  re-signing (adaptive to the host identity) and by the release gate with a
+  real Developer ID identity.
+
 ## 3. Deferred decisions
 
 ### D102 — Public native SDK and ABI policy
diff --git a/package-lock.json b/package-lock.json
index 60e4fe5..4128631 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1093,11 +1093,11 @@
     },
     "packages/light-ocr": {
       "name": "@arcships/light-ocr",
-      "version": "0.5.6",
+      "version": "0.5.7",
       "license": "Apache-2.0",
       "dependencies": {
         "@arcships/light-ocr-model-ppocrv6-small": "0.3.4",
-        "@arcships/light-ocr-runtime": "0.1.6"
+        "@arcships/light-ocr-runtime": "0.1.7"
       },
       "bin": {
         "light-ocr": "src/cli.cjs"
@@ -1108,10 +1108,10 @@
     },
     "packages/light-ocr-document": {
       "name": "@arcships/light-ocr-document",
-      "version": "0.1.2",
+      "version": "0.1.3",
       "license": "Apache-2.0",
       "dependencies": {
-        "@arcships/light-ocr": "0.5.6"
+        "@arcships/light-ocr": "0.5.7"
       },
       "bin": {
         "light-ocr-document": "src/cli.cjs"
@@ -1122,11 +1122,11 @@
     },
     "packages/light-ocr-medium": {
       "name": "@arcships/light-ocr-medium",
-      "version": "0.1.5",
+      "version": "0.1.6",
       "license": "Apache-2.0",
       "dependencies": {
         "@arcships/light-ocr-model-ppocrv6-medium": "0.1.0",
-        "@arcships/light-ocr-runtime": "0.1.6"
+        "@arcships/light-ocr-runtime": "0.1.7"
       },
       "bin": {
         "light-ocr-medium": "src/cli.cjs"
@@ -1279,11 +1279,11 @@
     },
     "packages/light-ocr-tiny": {
       "name": "@arcships/light-ocr-tiny",
-      "version": "0.1.5",
+      "version": "0.1.6",
       "license": "Apache-2.0",
       "dependencies": {
         "@arcships/light-ocr-model-ppocrv6-tiny": "0.1.0",
-        "@arcships/light-ocr-runtime": "0.1.6"
+        "@arcships/light-ocr-runtime": "0.1.7"
       },
       "bin": {
         "light-ocr-tiny": "src/cli.cjs"
@@ -1304,18 +1304,18 @@
     },
     "packages/runtime": {
       "name": "@arcships/light-ocr-runtime",
-      "version": "0.1.6",
+      "version": "0.1.7",
       "license": "Apache-2.0",
       "engines": {
         "node": "^22.0.0 || ^24.0.0"
       },
       "optionalDependencies": {
-        "@arcships/light-ocr-darwin-arm64": "0.5.6",
-        "@arcships/light-ocr-darwin-x64": "0.5.6",
-        "@arcships/light-ocr-linux-arm64-gnu": "0.5.6",
-        "@arcships/light-ocr-linux-x64-gnu": "0.5.6",
-        "@arcships/light-ocr-win32-arm64": "0.5.6",
-        "@arcships/light-ocr-win32-x64": "0.5.6"
+        "@arcships/light-ocr-darwin-arm64": "0.5.7",
+        "@arcships/light-ocr-darwin-x64": "0.5.7",
+        "@arcships/light-ocr-linux-arm64-gnu": "0.5.7",
+        "@arcships/light-ocr-linux-x64-gnu": "0.5.7",
+        "@arcships/light-ocr-win32-arm64": "0.5.7",
+        "@arcships/light-ocr-win32-x64": "0.5.7"
       }
     }
   }
diff --git a/packages/light-ocr-document/package.json b/packages/light-ocr-document/package.json
index 5033814..64beb8d 100644
--- a/packages/light-ocr-document/package.json
+++ b/packages/light-ocr-document/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@arcships/light-ocr-document",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "private": true,
   "description": "Compatibility entry for the document API built into light-ocr",
   "license": "Apache-2.0",
@@ -33,7 +33,7 @@
     "node": "^22.0.0 || ^24.0.0"
   },
   "dependencies": {
-    "@arcships/light-ocr": "0.5.6"
+    "@arcships/light-ocr": "0.5.7"
   },
   "scripts": {
     "test": "node --test test/*.test.cjs"
diff --git a/packages/light-ocr-medium/package.json b/packages/light-ocr-medium/package.json
index 8a4bbb0..1ce143c 100644
--- a/packages/light-ocr-medium/package.json
+++ b/packages/light-ocr-medium/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@arcships/light-ocr-medium",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "private": true,
   "description": "Offline PP-OCRv6 Medium OCR for Node.js — preview quality tier",
   "license": "Apache-2.0",
@@ -29,7 +29,7 @@
   },
   "dependencies": {
     "@arcships/light-ocr-model-ppocrv6-medium": "0.1.0",
-    "@arcships/light-ocr-runtime": "0.1.6"
+    "@arcships/light-ocr-runtime": "0.1.7"
   },
   "scripts": {
     "test": "node --test test/*.test.cjs"
diff --git a/packages/light-ocr-tiny/package.json b/packages/light-ocr-tiny/package.json
index 55ea450..22f160d 100644
--- a/packages/light-ocr-tiny/package.json
+++ b/packages/light-ocr-tiny/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@arcships/light-ocr-tiny",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "private": true,
   "description": "Offline PP-OCRv6 Tiny OCR for Node.js — preview size-first tier",
   "license": "Apache-2.0",
@@ -29,7 +29,7 @@
   },
   "dependencies": {
     "@arcships/light-ocr-model-ppocrv6-tiny": "0.1.0",
-    "@arcships/light-ocr-runtime": "0.1.6"
+    "@arcships/light-ocr-runtime": "0.1.7"
   },
   "scripts": {
     "test": "node --test test/*.test.cjs"
diff --git a/packages/light-ocr/README.md b/packages/light-ocr/README.md
index 890f139..385d692 100644
--- a/packages/light-ocr/README.md
+++ b/packages/light-ocr/README.md
@@ -269,6 +269,13 @@ Expected failures reject with `OcrError` and a stable `code`, including
 `invalid_argument`, `invalid_image`, `resource_limit_exceeded`,
 `package_load_failed`, and `inference_failed`.
 
+macOS packagers may re-sign the native binaries with their own Developer ID
+(or ad-hoc) identity, for example while notarizing a distributed app. The
+loader accepts a re-signed Mach-O on macOS when its code signature verifies
+and its signing identity matches the host application (same TeamIdentifier,
+or both ad-hoc signed); other platforms and unsigned mutations keep the
+strict size + SHA-256 gate and keep failing with `package_load_failed`.
+
 For environment reports:
 
 ```bash
diff --git a/packages/light-ocr/package.json b/packages/light-ocr/package.json
index c2094b1..da6d38b 100644
--- a/packages/light-ocr/package.json
+++ b/packages/light-ocr/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@arcships/light-ocr",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "private": true,
   "description": "Offline image and PDF OCR for Node.js — the stable PP-OCRv6 Small tier",
   "license": "Apache-2.0",
@@ -30,7 +30,7 @@
   },
   "dependencies": {
     "@arcships/light-ocr-model-ppocrv6-small": "0.3.4",
-    "@arcships/light-ocr-runtime": "0.1.6"
+    "@arcships/light-ocr-runtime": "0.1.7"
   },
   "scripts": {
     "test": "node --test test/*.test.cjs"
diff --git a/packages/runtime/package.json b/packages/runtime/package.json
index d701c49..683f273 100644
--- a/packages/runtime/package.json
+++ b/packages/runtime/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@arcships/light-ocr-runtime",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "private": true,
   "description": "Model-free Node.js runtime for light-ocr",
   "license": "Apache-2.0",
@@ -28,12 +28,12 @@
     "node": "^22.0.0 || ^24.0.0"
   },
   "optionalDependencies": {
-    "@arcships/light-ocr-darwin-arm64": "0.5.6",
-    "@arcships/light-ocr-darwin-x64": "0.5.6",
-    "@arcships/light-ocr-linux-arm64-gnu": "0.5.6",
-    "@arcships/light-ocr-linux-x64-gnu": "0.5.6",
-    "@arcships/light-ocr-win32-arm64": "0.5.6",
-    "@arcships/light-ocr-win32-x64": "0.5.6"
+    "@arcships/light-ocr-darwin-arm64": "0.5.7",
+    "@arcships/light-ocr-darwin-x64": "0.5.7",
+    "@arcships/light-ocr-linux-arm64-gnu": "0.5.7",
+    "@arcships/light-ocr-linux-x64-gnu": "0.5.7",
+    "@arcships/light-ocr-win32-arm64": "0.5.7",
+    "@arcships/light-ocr-win32-x64": "0.5.7"
   },
   "scripts": {
     "test": "node --test test/*.test.cjs"
diff --git a/packages/runtime/src/load-native.cjs b/packages/runtime/src/load-native.cjs
index 8b7261b..45fd5c1 100644
--- a/packages/runtime/src/load-native.cjs
+++ b/packages/runtime/src/load-native.cjs
@@ -1,9 +1,101 @@
 'use strict';
 
+const { spawnSync } = require('node:child_process');
 const crypto = require('node:crypto');
 const fs = require('node:fs');
 const path = require('node:path');
 
+// macOS-only integrity relaxation for downstream re-signing.
+//
+// macOS packaging pipelines re-sign the native payload with a Developer ID
+// (or ad-hoc) identity, and osx-sign rewrites the LC_CODE_SIGNATURE blob of
+// every Mach-O under Contents --force. That changes both file size and
+// sha256, so the strict descriptor comparison alone rejects otherwise intact
+// binaries. On macOS only, a Mach-O whose signature verifies AND whose
+// signing identity matches the host process is accepted as an equivalent
+// integrity proof: same TeamIdentifier as process.execPath, or both sides
+// ad-hoc signed. Ad-hoc signatures are reproducible by anyone, so this
+// relaxation stays macOS-only and documented; win32/linux payloads are never
+// re-signed and keep the strict bytes+sha256 gate.
+
+const MACHO_MAGIC = new Set([
+  0xfeedface, // 32-bit big-endian
+  0xcefaedfe, // 32-bit little-endian
+  0xfeedfacf, // 64-bit big-endian
+  0xcffaedfe, // 64-bit little-endian
+  0xcafebabe, // universal (fat) big-endian
+  0xbebafeca, // universal (fat) little-endian
+]);
+
+function isMachO(filename) {
+  const fd = fs.openSync(filename, 'r');
+  try {
+    const magic = Buffer.allocUnsafe(4);
+    if (fs.readSync(fd, magic, 0, 4, 0) !== 4) return false;
+    return MACHO_MAGIC.has(magic.readUInt32BE(0));
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+function codesignOutput(filename) {
+  const result = spawnSync('codesign', ['-dv', '--verbose=4', filename], {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  if (result.error || result.status !== 0) return null;
+  return `${result.stdout}\n${result.stderr}`;
+}
+
+// Returns { teamIdentifier, adhoc } for a readable signature, or null when
+// the file carries no readable signature (unsigned, corrupt, not Mach-O).
+function codesignIdentity(filename) {
+  const output = codesignOutput(filename);
+  if (!output) return null;
+  if (/^Signature=adhoc\s*$/m.test(output)) {
+    return { teamIdentifier: null, adhoc: true };
+  }
+  const teamLine = output.match(/^TeamIdentifier=(.*)$/m);
+  const teamIdentifier = teamLine ? teamLine[1].trim() : '';
+  if (teamIdentifier && teamIdentifier !== 'not set') {
+    return { teamIdentifier, adhoc: false };
+  }
+  return null;
+}
+
+function codesignVerifies(filename) {
+  const result = spawnSync('codesign', ['--verify', '--strict', filename], {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  return !result.error && result.status === 0;
+}
+
+let hostCodesignIdentityCache;
+
+function hostCodesignIdentity() {
+  if (hostCodesignIdentityCache === undefined) {
+    hostCodesignIdentityCache = codesignIdentity(process.execPath);
+  }
+  return hostCodesignIdentityCache;
+}
+
+// Accept a re-signature only when it was made with the same identity as the
+// host process: identical TeamIdentifier, or both sides ad-hoc signed.
+function signerMatchesHost(artifactIdentity, host = hostCodesignIdentity()) {
+  if (!artifactIdentity || !host) return false;
+  if (artifactIdentity.adhoc && host.adhoc) return true;
+  return !artifactIdentity.adhoc && !host.adhoc &&
+    artifactIdentity.teamIdentifier === host.teamIdentifier;
+}
+
+function acceptsSignedMacOSMutation(filename) {
+  if (process.platform !== 'darwin') return false;
+  if (!isMachO(filename)) return false;
+  if (!codesignVerifies(filename)) return false;
+  return signerMatchesHost(codesignIdentity(filename));
+}
+
 function adapterError(code, message, detail, cause) {
   const error = new Error(message, cause === undefined ? undefined : { cause });
   error.name = 'OcrError';
@@ -108,12 +200,23 @@ function verifyArtifact(root, artifact, field) {
   if (!stats.isFile() || stats.isSymbolicLink()) {
     throw adapterError('package_load_failed', 'Descriptor artifact is not a regular file', artifact.path);
   }
-  if (!Number.isSafeInteger(artifact.bytes) || artifact.bytes < 1 || stats.size !== artifact.bytes) {
+  if (!Number.isSafeInteger(artifact.bytes) || artifact.bytes < 1) {
     throw adapterError('package_load_failed', 'Descriptor artifact byte count mismatch', artifact.path);
   }
-  if (!/^[a-f0-9]{64}$/.test(artifact.sha256 || '') || sha256(filename) !== artifact.sha256) {
+  if (!/^[a-f0-9]{64}$/.test(artifact.sha256 || '')) {
     throw adapterError('package_load_failed', 'Descriptor artifact hash mismatch', artifact.path);
   }
+  if (stats.size !== artifact.bytes) {
+    if (!acceptsSignedMacOSMutation(filename)) {
+      throw adapterError('package_load_failed', 'Descriptor artifact byte count mismatch', artifact.path);
+    }
+    return filename;
+  }
+  if (sha256(filename) !== artifact.sha256) {
+    if (!acceptsSignedMacOSMutation(filename)) {
+      throw adapterError('package_load_failed', 'Descriptor artifact hash mismatch', artifact.path);
+    }
+  }
   return filename;
 }
 
@@ -496,4 +599,11 @@ function loadNative() {
   }
 }
 
-module.exports = { loadNative, validateRuntimeDescriptor };
+const macOSSignature = Object.freeze({
+  isMachO,
+  codesignIdentity,
+  codesignVerifies,
+  signerMatchesHost,
+});
+
+module.exports = { loadNative, validateRuntimeDescriptor, macOSSignature };
diff --git a/tools/npm_release.py b/tools/npm_release.py
index eaf3845..6d3db8f 100644
--- a/tools/npm_release.py
+++ b/tools/npm_release.py
@@ -61,12 +61,12 @@
     },
     "tiny": {
         "name": "@arcships/light-ocr-tiny",
-        "version": "0.1.5",
+        "version": "0.1.6",
         "workspace": "light-ocr-tiny",
     },
     "medium": {
         "name": "@arcships/light-ocr-medium",
-        "version": "0.1.5",
+        "version": "0.1.6",
         "workspace": "light-ocr-medium",
     },
 }