Zoom and Zotero read broken because codesign --strict also refuses Finder attributes, and the seal was intact

[opencdlee-dotcom]

Precision plan step S1 (PRECISION-PLAN-2026-09-23.md): the codesign parser.

The defect

_classify_mac filed every non-zero codesign --verify --strict that did not say "not signed" as broken. broken is in suspicious_sig(), so it gates the process, listener and beacon sensors at HIGH. On the reference Mac today:

binary	--verify --strict	--verify	chain
/Applications/zoom.us.app/Contents/MacOS/zoom.us	rc 1, resource fork, Finder information, or similar detritus not allowed	rc 0	Developer ID, BJ4HAAB9B3
/Applications/Zotero.app/Contents/MacOS/zotero	rc 1, same	rc 0	Developer ID, 8LAYR367YV

The complaint is about Finder xattrs inside the bundle. The seal is intact, and 36 HIGH interrupts in 30 days came from this. A real tamper reads differently and fails without --strict too.

The fix

When a strict failure names detritus (_STRICT_DETRITUS_MARKERS), _classify_mac asks once more without --strict, and the plain verify decides:

• passes: the chain's trust stands, and the verdict records strict: detritus
• fails with a reason: broken, as before
• times out, or fails silently: the PR Fourteen open incidents were five facts, and three of them were a probe that did not answer being filed as a verdict #52 non-answer (unknown, probe_failed, counted, never cached)

Every other strict failure is broken exactly as before and is not re-asked. The text only selects which failures get the second probe. The plain verify is what decides, so adding Finder info to a modified binary cannot launder it.

_SIGCACHE_LOGIC_VERSION goes from 3 to 4, so cached broken verdicts are re-probed on the next scan. Without the bump they would be served until the app's next update. test_false_alarm_batch_20260922's exact pin == 3 becomes >= 3 (required by the bump).

No new exit. _close_reverified_incidents already closes an OPEN signal incident gated on an untrusted verdict once the same path re-classifies as a publisher at a non-risky location. The live Zoom/Zotero incidents were outbound beacons on /Applications paths, and all of them are already closed. The new tests push that shape through the real parser into the exit.

Tests: tests/test_codesign_detritus.py

• Parser, mocked codesign, every body:
  • detritus plus a clean plain verify gives developer-id with strict: detritus
  • "modified" gives broken
  • detritus over a failing seal gives broken
  • only detritus earns the second probe
  • a timed-out or silent second probe is a non-answer
  • strict and -dv timeouts are unchanged
  • a v3 cached broken is re-probed
• The exit, through record_security_state (mac vocabulary):
  • a detritus-misread beacon closes FALSE_POSITIVE with a re-verified: … developer-id resolution
  • a real tamper stays OPEN
  • the scan that opens an incident does not close it
• Live, real Mac only (sys.platform == "darwin" and aegis.IS_MAC):
  • a copy of /bin/ls with com.apple.FinderInfo reproduces the exact detritus message and classifies apple
  • a byte-flipped copy plus FinderInfo stays broken
  • Zoom and Zotero classify developer-id where they are installed

🤖 Generated with Claude Code