The bundled whisper-cli / ggml dylibs JIT-compile Metal shaders at
runtime; under the hardened runtime that needs com.apple.security.cs.allow-jit
or the process gets killed. Completes the entitlement set for the
notarized Developer ID build (alongside device.audio-input).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The v1.2.0 Developer ID re-sign enabled the hardened runtime but the
entitlements were missing com.apple.security.device.audio-input. Under
the hardened runtime tccd refuses to even prompt for the microphone and
denies kTCCServiceMicrophone outright, so the app recorded pure silence
and whisper hallucinated text on the empty audio. Adding the resource
-access entitlement restores the mic permission prompt.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
WhisperDictate.entitlements: non-sandboxed hardened-runtime entitlements
(app-sandbox=false; cs.disable-library-validation for the bundled whisper-cli
+ ggml/whisper dylibs). Used to deep-sign the app with the company Developer ID
identity before notarization. Also ignore the stray Contents/CodeResources
signing artifact.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
