Infrastructure: Implement neutral macOS desktop application ownership and identity recovery #4446

Current status - 2026-11-07

Blocked by F2 #4442's exact ownership/claim contract (in #4463). Existing native evidence is session-owned launch or externally owned attach, not neutral supervisor-owned application lifetime.

Remaining work includes launch-capable discovery/ownership comparison, exact launch/attach incarnation and causal ownership, PID reuse/ambiguous identity/permission/publication/survivor failure cases, attached-app preservation, and separate macOS Fabric/Paper signing/TCC responsibility qualification. No automatic reclaim or retained-app handoff is implied by current recovery records.

Moving Storybook's existing attach lease waits for F9 #4449 only in that integration phase; do not make F9 a blocker for this backend's independent implementation. Retained-app handoff is a later F11 #4448 option, while attach-only handoff can proceed without it.

Goal

On macOS, attach identity (the application lease) lives in the Storybook integration, and there is no supervisor-owned launch: a launched app is owned by its driver session, and an attached app is owned externally. Move generic attach identity into the neutral harness and add opt-in supervisor-owned launch with exact identity recovery.

Part of #4435 (plan item F10-M).

Scope

• Owner: macOS lifecycle backend.
• Paths (under packages/agentic/): neutral application ownership adapters in desktop-test, and the driver's macOS authority and native support only where needed, with native contracts.
• Move generic attach-identity duties out of Storybook.
• Add opt-in supervisor-owned launch; attached applications stay external.
• Distinguish LaunchServices causal ownership from direct child-process ownership.
• Native helper changes follow the implement-native-component overlay and desktop-driver/native/PROTOCOL.md.
• Moving Storybook's existing lease code is an integration commit after F9 Infrastructure: Convert Storybook lifecycle takeover into desktop-test resource contributions #4449, not a blocker for backend work.

Dependencies

• Blocked by: F2 Infrastructure: Implement settled desktop lifecycle supervision and fenced ownership records #4442 (exact ownership and claim contract).
• Enables: the retained supervisor-launched app option in F11 Infrastructure: Add scoped runner grants and drain-confirmed desktop controller handoff #4448.
• Parallel with: F10-W Infrastructure: Implement neutral Windows desktop application ownership and containment #4447, F5 Infrastructure: Authorize and settle every controlled Storybook mutation entrance #4443, and F6 Infrastructure: Tighten Storybook manifest provenance and native helper trust handoff #4445.

Acceptance

• PID reuse, duplicate bundle identities, permission failure, interrupted publication, surviving descendants, and foreign or stale exit events fail closed.
• Attached applications survive cleanup; owned applications close by exact identity.
• Stable signing and TCC responsibility behavior is qualified on macOS Fabric and macOS Paper.

Validation

• Iterate with focused yarn test <name> in each changed package, then run its yarn format, yarn lint, yarn build, and yarn test. Finish with yarn clean-lage-cache then yarn lage buildci; run yarn lage test-links --verbose --grouped after markdown changes.
• Add a patch changeset for each changed published package. Update the owning references/current-status.md rows (done, work in progress, unsupported) and affected README/AGENTS guidance in the same change.
• Native, provider, or process-topology changes need matching-OS native contracts and the affected consumer lane. JavaScript tests and bundles do not qualify native behavior; hosted capability skips are not passes. Report each check as passed, failed, skipped, not run, or unsupported.

Evidence

• Current state: "Supervisor-owned app lifetime" in packages/agentic/desktop-test/references/current-status.md.
• Retired plan: driver-next.md at 0569e1b86, section 8 (F10-M).