macOS technical preview

Mac CLI and Daemon packages are in technical preview. Follow the installation steps below and review any macOS per-app security or privacy prompt without disabling system protection.

Choose and verify

Use physical hardware architecture: sysctl hw.optional.arm64 detects Apple silicon; uname -m can describe Rosetta. Use native Terminal. Each package matches the machine where it executes; technician and target architectures need not match each other. Download complete verified archive/manifest. The same release contains primary opalspan, compatible forge and forge-transport-helper; do not fabricate an unsigned alias.

Agent workstation

Run ./opalspan --version, ./opalspan credentials status and ./opalspan doctor before PATH configuration. Keychain is the provider. No sudo workstation installation. Install/repair needs --archive and --manifest; uninstall may use --root. Verified update installs per-user generation; profile sign-in remains independently authorized. Headless sign-in has protected handoff.

Customer Daemon / Rescue

Shared browser TAR contains only forge-host, release-manifest.json and signature; no README.txt or embedded code. Follow the shared page and enter separately supplied code at the private prompt. CLI-prepared folders are different and may include private code/instructions. No secret in chat/arguments/logs. Target Daemon uses root launchd; preview automatic-update/OS privacy limitations remain. Guarded cleanup removes only verified bootstrap/sidecars; scheduling is not completion. Mac inventory/startup sections exist but startup duration is unsupported, not measured. See Rescue and diagnostics.