# JB Pi macOS Control

A local observation-only derivative of CursorTouch/MacOS-MCP. Version `0.1.6` preserves the four-tool boundary and adds an atomic, self-contained file chain for each Evidence capture. Status, Snapshot, and bounded AX behavior are unchanged from frozen `0.1.5`.

`jb_mac_capture_evidence` now requires an approved target, `capture_scope="window"`, a restricted lowercase label, and purpose `calibration` or `acceptance`. The label is metadata only; internal unpredictable IDs own all paths. Each successful Evidence atomically publishes exactly:

```text
/tmp/jb-pi-macos-control/<safe-session-component>/evidence/<evidence-id>/
  capture.png
  manifest.json
```

`manifest.json` uses `jb.evidence-manifest.v1`; model-visible output remains `jb.evidence.v1` plus the independent validated PNG image item. Neither JSON/details nor audit contains image base64, a complete Session ID, a concrete digest, Window ID, scratch path, or sensitive absolute user path.

See `UPSTREAM.md`, `SECURITY.md`, `DEPENDENCIES.md`, `docs/ARCHITECTURE.md`, `docs/INSTALL-PLAN.md`, and `docs/BASELINE.md`.

```sh
./Scripts/verify.zsh
```

Lifecycle scripts default to dry-run. Approved upgrades are exactly `0.1.0 -> 0.1.2`, `0.1.2 -> 0.1.3`, `0.1.3 -> 0.1.4`, `0.1.4 -> 0.1.5`, and `0.1.5 -> 0.1.6`; execution requires the matching immutable tag, refuses a running old MCP, and uses macOS `RENAME_SWAP`.

The server remains stdio-only:

```sh
/usr/bin/python3 -m macos_mcp_jb.cli serve-readonly --transport stdio
```

## Configuration

`config/approved-targets.json` ships as an empty template. Fill it with the
exact signature identity (canonical path, bundle id, Team ID, CDHash, executable
and Info.plist SHA-256, designated requirement) of each macOS bundle you want the
snapshot/evidence tools to accept. `policy.py` rejects any target not listed
with a matching frozen allowlist entry.