plugin: add macOS platform security workflows

[gaelic-ghost]

Summary

• add Apple Dev workflows for macOS privacy permissions, sandboxed file access, and entitlement diagnosis
• add an exact-build Reverse Engineering workflow for macOS security controls
• align Cybersecurity handoffs, portable exports, host metadata, architecture docs, and forward scenarios
• bump the shared Socket version to 9.21.0

Validation

• Apple Dev: 276 passed, 174 subtests passed
• Reverse Engineering: 2 passed
• Cybersecurity: 2 passed
• Socket: 134 passed, 1 skipped
• Socket metadata, Hermes, Claude/Cowork, architecture, and Claude marketplace validation passed

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 163 files, which is 63 over the limit of 100.

To get a review, narrow the scope:
• coderabbit review --type committed # exclude uncommitted changes
• coderabbit review --dir # limit to a subdirectory
• coderabbit review --base # compare against a closer base

Upgrade to a paid plan to raise the limit.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 1076f5b0-93b1-4ff7-99af-ab7eed03851d

📥 Commits

Reviewing files that changed from the base of the PR and between 478aac9 and 7fc04c6.

⛔ Files ignored due to path filters (8)

• plugins/agent-portability-skills/uv.lock is excluded by !**/*.lock
• plugins/apple-dev-skills/uv.lock is excluded by !**/*.lock
• plugins/cardhop-app/mcp/uv.lock is excluded by !**/*.lock
• plugins/productivity-skills/uv.lock is excluded by !**/*.lock
• plugins/python-skills/uv.lock is excluded by !**/*.lock
• plugins/things-app/mcp/uv.lock is excluded by !**/*.lock
• plugins/things-app/uv.lock is excluded by !**/*.lock
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (163)

• .claude-plugin/marketplace.json
• ROADMAP.md
• docs/architecture/ARCHITECTURE.md
• docs/architecture/architecture.json
• docs/maintainers/claude-compatibility.json
• docs/maintainers/claude-compatibility.md
• docs/maintainers/hermes-compatibility.md
• docs/maintainers/macos-platform-security-skills-plan.md
• plugins/agent-portability-skills/.codex-plugin/plugin.json
• plugins/agent-portability-skills/pyproject.toml
• plugins/agentdeck/.codex-plugin/plugin.json
• plugins/android-dev-skills/.codex-plugin/plugin.json
• plugins/apple-creator-studio-skills/.codex-plugin/plugin.json
• plugins/apple-dev-skills/.codex-plugin/plugin.json
• plugins/apple-dev-skills/.github/scripts/validate_repo_docs.sh
• plugins/apple-dev-skills/README.md
• plugins/apple-dev-skills/ROADMAP.md
• plugins/apple-dev-skills/docs/maintainers/customization-consolidation-review.md
• plugins/apple-dev-skills/pyproject.toml
• plugins/apple-dev-skills/skills/app-extension-architecture-workflow/SKILL.md
• plugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/SKILL.md
• plugins/apple-dev-skills/skills/diagnose-apple-entitlements/SKILL.md
• plugins/apple-dev-skills/skills/diagnose-apple-entitlements/agents/openai.yaml
• plugins/apple-dev-skills/skills/diagnose-apple-entitlements/references/artifact-and-nested-code-inspection.md
• plugins/apple-dev-skills/skills/diagnose-apple-entitlements/references/customization-flow.md
• plugins/apple-dev-skills/skills/diagnose-apple-entitlements/references/customization.template.yaml
• plugins/apple-dev-skills/skills/diagnose-apple-entitlements/references/five-state-entitlement-comparison.md
• plugins/apple-dev-skills/skills/diagnose-apple-entitlements/references/restricted-and-private-entitlements.md
• plugins/apple-dev-skills/skills/diagnose-apple-entitlements/references/routing-and-validation.md
• plugins/apple-dev-skills/skills/diagnose-apple-entitlements/references/snippets/apple-xcode-project-core.md
• plugins/apple-dev-skills/skills/diagnose-apple-entitlements/scripts/customization_config.py
• plugins/apple-dev-skills/skills/file-provider-and-finder-sync-workflow/SKILL.md
• plugins/apple-dev-skills/skills/macos-distribution-workflow/SKILL.md
• plugins/apple-dev-skills/skills/macos-privacy-permissions-workflow/SKILL.md
• plugins/apple-dev-skills/skills/macos-privacy-permissions-workflow/agents/openai.yaml
• plugins/apple-dev-skills/skills/macos-privacy-permissions-workflow/references/customization-flow.md
• plugins/apple-dev-skills/skills/macos-privacy-permissions-workflow/references/customization.template.yaml
• plugins/apple-dev-skills/skills/macos-privacy-permissions-workflow/references/permission-class-matrix.md
• plugins/apple-dev-skills/skills/macos-privacy-permissions-workflow/references/prompting-settings-reset-and-mdm.md
• plugins/apple-dev-skills/skills/macos-privacy-permissions-workflow/references/responsible-code-and-attribution.md
• plugins/apple-dev-skills/skills/macos-privacy-permissions-workflow/references/snippets/apple-xcode-project-core.md
• plugins/apple-dev-skills/skills/macos-privacy-permissions-workflow/references/validation-fixtures.md
• plugins/apple-dev-skills/skills/macos-privacy-permissions-workflow/scripts/customization_config.py
• plugins/apple-dev-skills/skills/macos-sandbox-file-access-workflow/SKILL.md
• plugins/apple-dev-skills/skills/macos-sandbox-file-access-workflow/agents/openai.yaml
• plugins/apple-dev-skills/skills/macos-sandbox-file-access-workflow/references/customization-flow.md
• plugins/apple-dev-skills/skills/macos-sandbox-file-access-workflow/references/customization.template.yaml
• plugins/apple-dev-skills/skills/macos-sandbox-file-access-workflow/references/helpers-groups-and-process-boundaries.md
• plugins/apple-dev-skills/skills/macos-sandbox-file-access-workflow/references/sandbox-and-filesystem-control-map.md
• plugins/apple-dev-skills/skills/macos-sandbox-file-access-workflow/references/security-scoped-bookmark-lifecycle.md
• plugins/apple-dev-skills/skills/macos-sandbox-file-access-workflow/references/snippets/apple-xcode-project-core.md
• plugins/apple-dev-skills/skills/macos-sandbox-file-access-workflow/references/validation-fixtures.md
• plugins/apple-dev-skills/skills/macos-sandbox-file-access-workflow/scripts/customization_config.py
• plugins/apple-dev-skills/skills/xcode-build-run-workflow/SKILL.md
• plugins/apple-dev-skills/tests/test_app_extension_workflows.py
• plugins/apple-dev-skills/tests/test_apple_developer_provisioning_workflow.py
• plugins/apple-dev-skills/tests/test_arkit_spatial_face_body_workflows.py
• plugins/apple-dev-skills/tests/test_camera_capture_depth_workflow.py
• plugins/apple-dev-skills/tests/test_customization_consolidation_review.py
• plugins/apple-dev-skills/tests/test_devicecheck_app_attest_workflow.py
• plugins/apple-dev-skills/tests/test_imaging_foundation_workflows.py
• plugins/apple-dev-skills/tests/test_macos_platform_security_workflows.py
• plugins/apple-dev-skills/tests/test_macos_virtualization_workflows.py
• plugins/apple-dev-skills/tests/test_photos_library_editing_workflow.py
• plugins/apple-dev-skills/tests/test_tipkit_workflow.py
• plugins/apple-dev-skills/tests/test_video_codec_processing_workflow.py
• plugins/apple-dev-skills/tests/test_vision_recognition_workflows.py
• plugins/apple-dev-skills/tests/test_xcode_localization_workflow.py
• plugins/cardhop-app/.codex-plugin/plugin.json
• plugins/cardhop-app/mcp/pyproject.toml
• plugins/cloud-deployment-skills/.codex-plugin/plugin.json
• plugins/cloud-inference-skills/.codex-plugin/plugin.json
• plugins/cybersecurity-skills/.codex-plugin/plugin.json
• plugins/cybersecurity-skills/skills/assess-macos-threat/SKILL.md
• plugins/cybersecurity-skills/skills/assess-macos-threat/references/macos-security-layers.md
• plugins/cybersecurity-skills/skills/contain-and-recover-macos/SKILL.md
• plugins/cybersecurity-skills/skills/harden-macos/SKILL.md
• plugins/cybersecurity-skills/skills/inspect-macos-runtime-activity/SKILL.md
• plugins/cybersecurity-skills/skills/inspect-macos-runtime-activity/references/macos-runtime-evidence.md
• plugins/cybersecurity-skills/skills/prepare-isolated-analysis-lab/SKILL.md
• plugins/cybersecurity-skills/skills/select-analysis-isolation/SKILL.md
• plugins/cybersecurity-skills/tests/test_macos_security_handoffs.py
• plugins/dotnet-skills/.codex-plugin/plugin.json
• plugins/game-dev-skills/.codex-plugin/plugin.json
• plugins/messaging-collaboration-skills/.codex-plugin/plugin.json
• plugins/model-lab-skills/.codex-plugin/plugin.json
• plugins/network-protocol-skills/.codex-plugin/plugin.json
• plugins/productivity-skills/.codex-plugin/plugin.json
• plugins/productivity-skills/pyproject.toml
• plugins/python-skills/.codex-plugin/plugin.json
• plugins/python-skills/pyproject.toml
• plugins/reverse-engineering-skills/.codex-plugin/plugin.json
• plugins/reverse-engineering-skills/skills/audit-apple-signing-and-containment/SKILL.md
• plugins/reverse-engineering-skills/skills/evidence-notes-workflow/SKILL.md
• plugins/reverse-engineering-skills/skills/perform-apple-dynamic-analysis/SKILL.md
• plugins/reverse-engineering-skills/skills/report-apple-security-research/SKILL.md
• plugins/reverse-engineering-skills/skills/research-macos-security-control/SKILL.md
• plugins/reverse-engineering-skills/skills/research-macos-security-control/agents/openai.yaml
• plugins/reverse-engineering-skills/skills/research-macos-security-control/references/control-research-matrix.md
• plugins/reverse-engineering-skills/skills/research-macos-security-control/references/exact-build-probe-design.md
• plugins/reverse-engineering-skills/skills/research-macos-security-control/references/source-and-evidence-hierarchy.md
• plugins/reverse-engineering-skills/skills/research-macos-security-control/references/technical-note-contract.md
• plugins/reverse-engineering-skills/tests/test_research_macos_security_control.py
• plugins/rust-skills/.codex-plugin/plugin.json
• plugins/server-side-jvm/.codex-plugin/plugin.json
• plugins/server-side-swift/.codex-plugin/plugin.json
• plugins/spotify/.codex-plugin/plugin.json
• plugins/swift-lang/.codex-plugin/plugin.json
• plugins/swiftasb-skills/.codex-plugin/plugin.json
• plugins/things-app/.codex-plugin/plugin.json
• plugins/things-app/mcp/pyproject.toml
• plugins/things-app/pyproject.toml
• plugins/web-dev-skills/.codex-plugin/plugin.json
• pyproject.toml
• scripts/export_hermes_skills.py
• skills.sh.json
• skills/app-extension-architecture-workflow/SKILL.md
• skills/assess-macos-threat/SKILL.md
• skills/assess-macos-threat/references/macos-security-layers.md
• skills/contain-and-recover-macos/SKILL.md
• skills/diagnose-apple-entitlements/SKILL.md
• skills/diagnose-apple-entitlements/agents/openai.yaml
• skills/diagnose-apple-entitlements/references/artifact-and-nested-code-inspection.md
• skills/diagnose-apple-entitlements/references/customization-flow.md
• skills/diagnose-apple-entitlements/references/customization.template.yaml
• skills/diagnose-apple-entitlements/references/five-state-entitlement-comparison.md
• skills/diagnose-apple-entitlements/references/restricted-and-private-entitlements.md
• skills/diagnose-apple-entitlements/references/routing-and-validation.md
• skills/diagnose-apple-entitlements/references/snippets/apple-xcode-project-core.md
• skills/diagnose-apple-entitlements/scripts/customization_config.py
• skills/file-provider-and-finder-sync-workflow/SKILL.md
• skills/harden-macos/SKILL.md
• skills/inspect-macos-runtime-activity/SKILL.md
• skills/inspect-macos-runtime-activity/references/macos-runtime-evidence.md
• skills/macos-privacy-permissions-workflow/SKILL.md
• skills/macos-privacy-permissions-workflow/agents/openai.yaml
• skills/macos-privacy-permissions-workflow/references/customization-flow.md
• skills/macos-privacy-permissions-workflow/references/customization.template.yaml
• skills/macos-privacy-permissions-workflow/references/permission-class-matrix.md
• skills/macos-privacy-permissions-workflow/references/prompting-settings-reset-and-mdm.md
• skills/macos-privacy-permissions-workflow/references/responsible-code-and-attribution.md
• skills/macos-privacy-permissions-workflow/references/snippets/apple-xcode-project-core.md
• skills/macos-privacy-permissions-workflow/references/validation-fixtures.md
• skills/macos-privacy-permissions-workflow/scripts/customization_config.py
• skills/macos-sandbox-file-access-workflow/SKILL.md
• skills/macos-sandbox-file-access-workflow/agents/openai.yaml
• skills/macos-sandbox-file-access-workflow/references/customization-flow.md
• skills/macos-sandbox-file-access-workflow/references/customization.template.yaml
• skills/macos-sandbox-file-access-workflow/references/helpers-groups-and-process-boundaries.md
• skills/macos-sandbox-file-access-workflow/references/sandbox-and-filesystem-control-map.md
• skills/macos-sandbox-file-access-workflow/references/security-scoped-bookmark-lifecycle.md
• skills/macos-sandbox-file-access-workflow/references/snippets/apple-xcode-project-core.md
• skills/macos-sandbox-file-access-workflow/references/validation-fixtures.md
• skills/macos-sandbox-file-access-workflow/scripts/customization_config.py
• skills/prepare-isolated-analysis-lab/SKILL.md
• skills/research-macos-security-control/SKILL.md
• skills/research-macos-security-control/agents/openai.yaml
• skills/research-macos-security-control/references/control-research-matrix.md
• skills/research-macos-security-control/references/exact-build-probe-design.md
• skills/research-macos-security-control/references/source-and-evidence-hierarchy.md
• skills/research-macos-security-control/references/technical-note-contract.md
• skills/select-analysis-isolation/SKILL.md
• tests/test_macos_platform_security_forward_scenarios.py

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Review on demand using usage pricing

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch plugin/macos-platform-security

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}