chore: drop unused CloudKit entitlements and browser ATS exceptions

.github/workflows/ci-macos-compat.yml

@@ -161,21 +161,18 @@ jobs:
       # on a macOS version other than the one `release.yml` ships from. That is
       # the build + smoke steps below, and they now run FIRST and gate the job.
       #
-      # Previously the full ~1,500-test unit suite ran first and gated. That was
-      # backwards twice over:
+      # The full ~1,500-test unit suite runs after the build and smoke steps, not
+      # before them, for two reasons:
       #
       #   1. Those tests are OS-agnostic logic and already run on every PR in
-      #      ci.yml. Re-running them on two more macOS versions produced no
-      #      unique signal.
-      #   2. They failed on the macos-15 runner (async starvation, see
-      #      QUARANTINED_ON_COMPAT in scripts/ci-run-unit-tests.sh), so steps
-      #      13-15 -- the build and smoke test, the actual point -- were SKIPPED
-      #      on every run. The compatibility check never once verified
-      #      compatibility, for over a week, while five successive attempts to
-      #      quarantine the failing tests each fixed what was in front of them
-      #      and revealed the next thing.
+      #      ci.yml. Re-running them on more macOS versions gives no unique
+      #      signal.
+      #   2. They can fail on the macos-15 runner (async starvation, see
+      #      QUARANTINED_ON_COMPAT in scripts/ci-run-unit-tests.sh). If they
+      #      gated the job, a failure would skip the build and smoke steps,
+      #      the actual point, and the job would never verify compatibility.
       #
-      # Unit tests still run here, after, and are now informational: a failure
+      # Unit tests still run here, after, and are informational: a failure
       # marks the step red without failing the job. That keeps the data (and the
       # uploaded xcresult bundles) without letting OS-agnostic test noise mask
       # the one result this job exists to produce.

.github/workflows/ci.yml

@@ -780,8 +780,8 @@ jobs:
 
   # Independent of unit-tests: same "programa" scheme app build-app already
   # produces, so this reuses that artifact instead of paying for its own
-  # ~3 min build. Split out so it no longer serializes behind the unit-test
-  # shards either.
+  # ~3 min build. Split out so it does not serialize behind the unit-test
+  # shards.
   theme-picker-helper-regression:
     needs:
       - build-app

.github/workflows/release.yml

@@ -348,17 +348,15 @@ jobs:
         env:
           APPLE_PROVISION_PROFILE_BASE64: ${{ secrets.APPLE_PROVISION_PROFILE_BASE64 }}
         run: |
-          # REQUIRED now, despite the name of the check below. The app declares
-          # restricted entitlements (CloudKit), and an app carrying those with no
-          # embedded profile is killed by AMFI at launch for every user (POSIX 163)
-          # after signing and notarizing cleanly. This step still tolerates the
-          # secret being absent so the failure is reported by
-          # verify-provision-profile.sh with a full explanation, rather than as a
-          # bare base64 error here — that script is the gate, and it fails the
-          # build. Do not "fix" a red verify step by removing it.
+          # The app declares no restricted (com.apple.developer.*) entitlements
+          # today, so the profile is a safety net. Adding a restricted
+          # entitlement makes it required: without an embedded profile AMFI
+          # kills the app at launch (POSIX 163) even though signing and
+          # notarization pass. verify-provision-profile.sh is the gate for that
+          # case; do not "fix" a red verify step by removing it.
           if [ -z "$APPLE_PROVISION_PROFILE_BASE64" ]; then
             echo "No APPLE_PROVISION_PROFILE_BASE64 secret set; skipping profile embedding."
-            echo "The build will fail verification: this app declares restricted entitlements."
+            echo "verify-provision-profile.sh fails the build if the app declares restricted entitlements."
             echo "PROGRAMA_PROVISION_PROFILE=" >> "$GITHUB_ENV"
             exit 0
           fi

.gitignore

@@ -47,22 +47,10 @@ tests/visual_report.html
 # Local scratch (screenshots, etc.)
 tmp/
 tmp-*/
-node_modules
 
 # Working plan documents. These are scratch thinking, not deliverables, and they
 # accumulate fast enough to bury real docs in review diffs.
-#
-# `plans/*` rather than `plans/`: git cannot re-include a file whose parent
-# DIRECTORY is excluded, so the negation below only works against a glob on the
-# directory's contents. Do not "simplify" this to `plans/`.
-#
-# golden-tumbling-gray.md stays tracked because shipped code cites it as the
-# rationale for a security rule — Sources/MobileBridge/MobileBridgePush.swift
-# points at its "Security implications" section for why prompt and output text
-# never goes into a notification payload. Untracking it would leave that comment
-# pointing at a file nobody who clones the repo has.
-plans/*
-!plans/golden-tumbling-gray.md
+plans/
 
 # Agent-written recaps, written into the repo root by `programa recap`. The CLI
 # also drops a self-ignoring .gitignore inside the directory on first use; this

Resources/Info.plist

@@ -113,21 +113,6 @@
 			</array>
 		</dict>
 	</array>
-	<key>NSAppTransportSecurity</key>
-	<dict>
-		<key>NSAllowsArbitraryLoadsInWebContent</key>
-		<true/>
-		<key>NSExceptionDomains</key>
-		<dict>
-			<key>programa-loopback.localtest.me</key>
-			<dict>
-				<key>NSExceptionAllowsInsecureHTTPLoads</key>
-				<true/>
-				<key>NSIncludesSubdomains</key>
-				<true/>
-			</dict>
-		</dict>
-	</dict>
 	<key>SUAutomaticallyUpdate</key>
 	<true/>
 	<key>SUEnableAutomaticChecks</key>

SKILL.md

@@ -218,21 +218,9 @@ Use the same panel that renders `programa markdown open` for it, so lean on its
 
 ## Browser work
 
-Two browsers, two jobs. Do not reach for a Chrome extension for either.
+Do not reach for a Chrome extension. Programa has no built-in browser; browser work goes through Aside.
 
-- **Local previews, smoke tests, screenshots you read back, DOM checks, console errors:** use programa's embedded browser. It opens beside your pane, keeps its own profile, and never moves the user's focus:
-
-  ```bash
-  programa browser open-split http://localhost:3000            # prints the new surface id
-  programa browser --surface surface:7 snapshot --interactive  # interactive elements only
-  programa browser --surface surface:7 click "button.submit" --snapshot-after
-  programa browser --surface surface:7 screenshot --out /tmp/after.png
-  programa browser --surface surface:7 tab close
-  ```
-
-  `programa browser --help` lists the rest (wait, fill, eval, cookies, console, errors). Network routing, viewport control, and raw input injection are not available on WKWebView, so there are no commands for them. Over MCP the same calls are the `browser_*` tools of `programa-mcp`.
-
-- **Logged-in sites, private dashboards, CI logs, anything that needs the user's real browser profile:** use Aside through its MCP server if it is registered (tools from the `aside` server, or `aside-devtools` for raw Chrome DevTools control), or delegate a whole task from the shell:
+- **Previews, smoke tests, screenshots, DOM checks, console errors, logged-in sites, private dashboards, CI logs:** use Aside through its MCP server if it is registered (tools from the `aside` server, or `aside-devtools` for raw Chrome DevTools control), or delegate a whole task from the shell:
 
   ```bash
   aside "Open the staging dashboard and tell me whether the last deploy is green"

Sources/ProgramStatus.swift

@@ -2,7 +2,7 @@
 //
 // Ghostty's parser has already validated every report before the action reaches Swift. The
 // checks here are defense in depth, so the store never holds a record the sidebar or the socket
-// could not safely show. See docs/plans/osc7501-program-status.md (D6, D7).
+// could not safely show. See docs/program-status.md.
 import Foundation
 
 enum ProgramStatusState: String, Sendable, CaseIterable {

docs/README.md

@@ -34,7 +34,7 @@
 
 ## Plans
 
-Design and planning documents. Each starts with a `Status:` line.
+Design and planning documents. Most start with a `Status:` line.
 
 - [plans/agent-events.md](plans/agent-events.md): normalized agent lifecycle events.
 - [plans/agent-state-unification.md](plans/agent-state-unification.md): one source of agent state and one sidebar indicator.

docs/ghostty-fork.md

@@ -194,12 +194,12 @@ tend to conflict together during rebases.
 ### cursor-click-to-move respects OSC 133 click-to-move
 
 - Was local in the fork as `10a585754`.
-- Landed upstream as `bb646926f`, so it is no longer carried as a fork-only patch.
+- Landed upstream as `bb646926f`, so the fork does not carry it as a separate patch.
 
 ### zsh prompt redraw follow-ups
 
 - Were local in the fork as `8ade43ce5`, `0cf559581`, `312c7b23a`, and `404a3f175`.
-- Dropped during the March 30, 2026 rebase because newer Ghostty prompt-marking changes on the refreshed base superseded these fork-only zsh redraw patches, so Programa no longer carries them separately.
+- Not carried: newer Ghostty prompt-marking changes on the current base supersede these fork-only zsh redraw patches (dropped in the March 30, 2026 rebase).
 
 ### initial focus seeding and DECSET 1004 startup behavior