Desktop Sessions and macOS Keychain

The desktop main process owns the complete Cognito session. Login, load, and refresh IPC return only ID/access tokens, their expiry, and any storage warning. The renderer requests refresh without sending a refresh token; there is no renderer token-persistence endpoint. Web and mobile retain their existing token storage and refresh behavior.

Electron 44.4.5 provides asynchronous safeStorage operations. Its interoperability tests cover decrypting synchronous ciphertext with the async API, so existing auth-tokens.enc files can be loaded directly. A shouldReEncrypt result causes an atomic replacement encrypted with the current key. Denied access, temporary unavailability, invalid stored data, and failed writes preserve the existing encrypted file. No plaintext fallback is used. Login/refresh can continue with credentials in memory and a visible warning when saving fails.

Logout clears in-memory credentials, cancels pending login, invalidates delayed OAuth/refresh/storage results, and removes the encrypted file. A removal failure is shown to the user rather than ignored.

Production Signing Evidence

The completed production releases on 1 October 2026 and 2 October 2026 both used:

• Bundle identifier: studio.kinesis.tailspend.desktop.
• Developer ID Application authority: Fraser Benjamin (team ID redacted by Actions).
• Signing certificate SHA-1: 800C20AF61B41768B5310E7527723A94694A4259.
• The same identity for the Intel and Apple silicon bundles.

Both runs passed the packaged app's signature, notarization, and Gatekeeper checks. Release validation now also checks the configured Apple Developer team and bundle identifier and records the identity in the run summary.

This establishes consistent signing for those releases. It does not establish whether an installed app prompts again after an update, or whether the reported installation was signed. That investigation remains open under #607.

Signed Update Verification

Use a test account and a Mac with a signed production installation copied to Applications. Do not substitute npm run dev or an unsigned local package.

1. Record the app version and codesign --display --verbose=4 /Applications/TailSpend.app output, including its identifier, authority, and team. Note whether this is the installation that reported repeated prompts.
2. Sign in, allow Keychain access, then quit and reopen. Confirm the saved session restores and record any prompt.
3. Install a subsequent signed production version through the app updater. Record its version and signing identity and whether restoring the existing session causes a new permission prompt. Confirm the identities match.
4. With a separate test session, deny or temporarily lock Keychain access. Confirm the app remains responsive, explains the failure, and preserves the encrypted session. Restore access, reopen, and confirm recovery.
5. Sign out, quit, and reopen. Confirm the app is signed out and auth-tokens.enc has been removed from the app's user-data directory.

Record versions, identities, prompt counts, and outcomes in #607 before closing its signed-update acceptance criterion. Automated tests cover storage migration handling, key rotation, recoverable errors, IPC isolation, and logout races; they do not substitute for this installed-release check.