[zzwong]

Why

macOS Keychain grants can be tied to the hash of an ad-hoc-signed CLI, so replacing a binary can prompt again for each stored credential. The shared credstore currently reads secrets through the caller binary.

Change

Read macOS Keychain generic passwords through the fixed system-signed /usr/bin/security executable, preserving the existing service/account mapping. Keep native Keychain writes, metadata, listing, and deletion; do not pass secrets on command lines or change stored entries. Add hermetic tests and update the shared guidance.

Verification

• go test -race ./... — passed
• go build ./... — passed
• go test -tags keyring_no1password,keyring_nopassage ./credstore — passed
• git diff --check — passed
• make check — lint could not complete locally: installed golangci-lint panicked loading a dependency that reports Go 1.27 syntax while the local tool was built with Go 1.26

Release follow-up

Before release, build a consumer against this commit, grant Keychain access once, rebuild it, and verify a second read without a prompt. Coordinate consumer dependency bumps and releases after that check.