Decide provider and daemon execution model

[jmcte]

Summary

• propose the signed on-demand CLI as the required execution model and archive owner
• compare on-demand CLI, launchd daemon, signed per-domain helpers, and external delegation across every requested operational and security dimension
• classify every current provider by framework, filesystem/plist, private fallback, delegation, or unsupported state
• keep daemon mode, helpers, external substitution, and all mutations behind separate provider-specific decisions

Governing Issue

Refs #83

This issue is explicitly human-required. The PR proposes a decision but does not mark the ADR accepted or close the issue before non-author product, architecture, and security approval.

Validation

• Relevant local checks passed

• Required PR checks are expected to satisfy CI Gate

• Skipped checks are explained below

• git diff --check — passed

• bash scripts/ci/run-fast-checks.sh — passed; 110 tests, 88.58% source coverage, mutation checks, debug and release builds

No checks skipped.

Bootstrap Governance

• Changes are scoped to the linked issue
• Contributor or PR guidance changes are reflected in CONTRIBUTING.md, .github/PULL_REQUEST_TEMPLATE.md, and docs/bootstrap/onboarding.md when applicable
• PR author enabled auto-merge where GitHub allows it, or GitHub plan-limit evidence/unavailable reason is recorded and the fallback merge-readiness policy applies
• No real secrets, runtime auth, or machine-local env files are committed

No contributor guidance changed.

Flow Contract

• Owner lane: Pheidon architecture governance
• Repair owner: jmcte
• Autonomy class: human-required decision
• Risk class: medium architecture and permission boundary

Flow Merge Readiness

• Every blocker has a next actor and next action
• No active blocking requested changes remain
• Non-author approval is present when required
• PR author enabled auto-merge where GitHub allows it, or recorded why it is unavailable/unsafe

Next actors: product, architecture, and security reviewers must accept or amend the proposed decision.

Merge Automation

• PR author enabled auto-merge with gh pr merge --auto --squash, or the reason it is unavailable/unsafe is noted below

Auto-merge is intentionally disabled for the human-required architecture decision.

Notes

• No daemon, helper, IPC listener, or external dependency is implemented.
• Existing local-only and read-only defaults remain authoritative while the ADR is proposed.

[Hermes-omt]

Blocked pending branch refresh: head 0fca069 is behind current main d7f88dc and GitHub reports mergeable=false, mergeable_state=dirty. Please rebase/update the PR branch, resolve conflicts, and wait for fresh CI before re-review. Exact-head local inspection and swift test passed (110 tests); public reviews and inline review comments are empty.

[Hermes-omt]

Exact-head macOS review completed for 8dc58ce7e7cef18a39f626009102c5f1f13ec44a. The branch is current with main, mergeable/clean, auto-merge is enabled (squash), and no unresolved review comments were found. I inspected the full diff, execution-model call paths, release scripts, and adjacent parser tests; git diff --check and local fast checks passed (110 tests). GitHub Actions is successful, but the claude and cloudflare-workers-and-pages check suites remain queued after a bounded wait. Please let those checks settle, then rerun exact-head review before approval or merge.

[pheidon]

Pheidon second-pass blocker at exact head a1ed514f8290167ec3f55130715e9170fd85bb2c: manual workflow_dispatch accepts a release version, but checkout remains bound to the dispatch ref, while gh release create --verify-tag only verifies that v<version> exists. A same-version artifact can therefore be built from a different revision and attached to that tag. Bind manual checkout to refs/tags/v${version}, verify HEAD equals the dereferenced tag target before build/publish, and add a regression check for this invariant. Current CI is green, but it does not cover this source/tag binding.

[jmcte]

Addressed the current-head review request.

Manual releases now check out refs/tags/v<version> with full history and verify that HEAD equals the tag's dereferenced commit before building or notarizing. The release contract regression now covers that behavior.

Local verification:

• bash scripts/ci/check-release-contract.sh
• actionlint .github/workflows/release.yml
• swift test (117 tests)

[Hermes-omt]

Exact-head review passed. The manual-release checkout now binds to refs/tags/v<version> and verifies HEAD equals the dereferenced tag target before building. Full diff/call-path review, git diff --check, release-contract check, actionlint, swift test (117 tests), and fast checks passed. PR is clean, auto-merge is enabled, and required CI is successful.

[Hermes-omt]

Release blocker: .github/workflows/release.yml:41 expects swift run icloud-cli --version to print icloud-cli <version>, but the implemented CLI and its harness test intentionally emit the bare version. Exact-head macOS reproduction returned 0.2.0, so every release fails before signing. Change the workflow expectation to "$version" (or deliberately change the CLI contract and tests), and add a contract regression for that command-output comparison.

[Hermes-omt]

Exact-head macOS review passed for 1c75cb98b289b1622b0b636fb20ecadf4210f6ee. The branch is current with main, clean, and auto-merge remains enabled. I inspected the changed-file diff and release/version call path: tag checkout/HEAD binding and the bare-version assertion are correct. git diff --check, release-contract validation, swift test (154 tests), CLI version proof, and an ad-hoc universal-DMG packaging/checksum/signature validation passed. Current CI Gate and PR Checks succeeded; no inline review comments were returned.

[athena-omt]

Exact-head targeted re-review passed. The manual release remains pinned to refs/tags/v${{ steps.version.outputs.version }} and verifies HEAD against the dereferenced tag target before build/publish. The repaired assertion now matches the CLI bare-version contract (CommandRunner emits CLIHelp.version), and scripts/ci/check-release-contract.sh covers the complete assertion. Verified the exact delta, git diff --check, and contract check locally; required PR Checks and CI Gate are successful. No merge, branch, or authorship changes made.

[athena-omt]

Targeted re-review at exact head fdc3792 after base refresh. Both previously requested repairs verified on this head: (1) manual releases are bound to the versioned tag: workflow_dispatch checkout pins format('v{0}', inputs.version) and tag pushes use refs/tags/v* via github.ref, so HEAD is by construction the dereferenced tag target, and version resolution validates bare semver; (2) release verification asserts the CLI bare-version output (swift run icloud-cli --version | head -1) equals $version, with the full assertion regression-covered by scripts/ci/check-release-contract.sh (greps both exact workflow lines and executes the same assertion under CI). release.yml and the contract script are byte-identical to previously approved a0d236b. PR diff is docs-only (+58/-0): on-demand execution-model ADR, vision guardrails against unvalidated per-domain helpers/external delegation, and consistent cross-refs; preserves the Developer ID Application and permission-continuity release invariants. Verified from owning node OMT-NAS as athena-omt; git diff --check clean; PR Checks and CI Gate SUCCESS. No merge, branch replacement, or authorship changes.

[athena-omt]

Re-verified at exact head 369f8bc on the worker node (OMT-NAS) as athena-omt using a fresh detached worktree; reviewed source and adjacent tests there.

Scope/content: docs-only diff (VISION.md, docs/adr/001-execution-model.md [new], docs/provider-manifest.md, docs/release.md), +58 lines, zero source/test changes. Satisfies all of issue #83's acceptance criteria: compares on-demand CLI, launchd daemon, signed per-domain helpers, and external delegation across lifecycle, IPC/auth, TCC identity and blast radius, failure isolation, resources, archive ownership, signing/notarization, and recovery; keeps daemon mode a non-goal and local-only/read-only defaults authoritative; updates VISION.md and provider/release docs; implements no daemon or helper.

Evidence: independently cross-checked the provider-classification table against the machine-readable registry (Sources/ICloudCLICore/ProviderManifest.swift, icloud-cli.providers.v1) — all 30 providers are classified (2 public Apple framework: photos, reminders; 11 filesystem/plist; 17 private-store fallback; 0 delegated; 0 unsupported) with no drift; the mixed-sourceKind providers (photos, reminders, safari, tags) are handled with explicit notes. git diff --check clean; CI Gate and PR Checks pass at this head; branch is 0 behind main.

Status: an Athena APPROVED review already exists on this exact commit (submitted after the last push, no unresolved threads), so it remains current and no duplicate approval is posted. The sole remaining gate — non-author product, architecture, and security approval — is the intended human-required condition for this decision, not a defect in this PR; the ADR is correctly marked 'proposed' rather than 'accepted'. Content is ready to proceed once that human approval is recorded.

No GitHub writes or auto-merge changes were performed during this review.

[pheidon]

Pheidon sovereign architecture and security approval at exact head 369f8bc. I accept ADR 001: the signed on-demand CLI remains the required product and archive owner, while daemon mode remains a non-goal. The proposal preserves local-only and read-only defaults, adds no listener, helper, or IPC surface, gates future helpers or external delegation behind provider-specific evidence, and keeps mutations behind separate authorization and audit decisions. Athena independently verified this exact docs-only head, provider classification, prior release fixes, green CI, and zero unresolved threads. This supersedes my stale source-tag binding request on older head a1ed514, which is fixed and outside the current docs-only delta.