Darwin CLI cross-build driver

adds a repository-owned build driver for producing caco Darwin CLI binaries without requiring the release workflow itself to run on the release-capable macOS host.

The driver is intentionally narrow: it builds the Rust caco CLI binary and writes the release artifact shape used by GitHub Releases (caco-darwin-arm64 or caco-darwin-x86_64). It does not package the native macOS companion app; that remains owned by the macOS app workflows.

Script

./scripts/build-darwin-caco.sh aarch64-apple-darwin dist/caco-darwin-arm64
./scripts/build-darwin-caco.sh x86_64-apple-darwin dist/caco-darwin-x86_64

The script supports these modes through CACO_DARWIN_BUILD_MODE:

auto (default): use native Cargo on Darwin hosts, otherwise use Nix mode.
native: run cargo build --release --target <apple-darwin-target> -p caco inside nix develop .#ci-release. This is the current self-hosted macOS release-runner path.
nix: run nix build .#packages.<darwin-system>.caco and copy $out/bin/caco into the requested artifact path.

Variable	Purpose
`CACO_DARWIN_BUILD_MODE`	`auto`, `native`, or `nix`.
`CACO_DARWIN_NIX_BUILDER`	Optional Nix `--builders` line for a Darwin remote builder. Required for `nix` mode from Linux.
`CACO_DARWIN_NIX_OUT_LINK`	Override the local Nix result symlink.
`CARGO_BUILD_JOBS`	Cargo parallelism for native mode, defaulting to `2`.
`CACO_DARWIN_TARGET_DIR`	Cargo target directory for native mode.
`CACO_CI_NIX_CACHE_PROBE_SECONDS`	Existing per-HTTP-peer probe bound, default `2`, accepted range `1`–`10` seconds.

Native shell entry and cache peers

Before realizing the native ci-release shell, the driver uses ci-nix-peer-failover.sh --exec to pass the existing bounded cache policy directly to that Nix invocation. It does not rely on GITHUB_ENV, which affects later Actions steps rather than the current process. The helper's no-argument mode retains its existing following-step behavior.

GNU timeout remains the usual HTTP probe backend; when unavailable on Darwin, the fixed system /usr/bin/curl provides bounded direct HTTP probes without first realizing a Nix dependency. Missing bootstrap support fails before realization instead of installing tools or changing host configuration.

TLS, non-HTTP, and authentication/query-bearing cache URIs remain opaque and are preserved for Nix; existing credential and trust settings are retained, and URI diagnostics omit credentials/query values. The shared host lock, Apple linker/SDK isolation, Cargo/Nix resource caps, target/profile, artifact and signing flow are unchanged. The Nix/remote-builder branch is not changed by this native-entry policy.

Non-Darwin orchestration

From Linux, Darwin binaries are built by Nix while the actual Darwin derivation is executed on a configured Darwin builder:

CACO_DARWIN_BUILD_MODE=nix \
CACO_DARWIN_NIX_BUILDER='ssh-ng://mac-builder aarch64-darwin - 2 1 big-parallel' \
./scripts/build-darwin-caco.sh aarch64-apple-darwin dist/caco-darwin-arm64

This keeps Linux release orchestration in control while preserving the legal/platform requirement that Apple Darwin artifacts are produced by a Darwin-capable builder.

Emulation / Rosetta path

On Apple Silicon macOS hosts with Nix configured for Rosetta (extra-platforms = x86_64-darwin aarch64-darwin), use nix mode for an emulated Intel Darwin build:

CACO_DARWIN_BUILD_MODE=nix \
./scripts/build-darwin-caco.sh x86_64-apple-darwin dist/caco-darwin-x86_64

The same script can cover native aarch64-darwin builds, Linux-driven builds through an SSH Nix Darwin builder, and Rosetta/extra-platform emulated x86_64-darwin builds from Apple Silicon.

Release workflow integration

.github/workflows/release.yml has two Darwin CLI producers:

build-darwin: native self-hosted macOS runner path, enabled with CACO_RELEASE_ENABLE_MACOS=true and disabled when the cross-driver job is explicitly enabled.
build-darwin-cross: Linux runner path, enabled with CACO_RELEASE_DARWIN_CROSS_BUILD=true; it calls scripts/build-darwin-caco.sh in nix mode and passes CACO_DARWIN_NIX_BUILDER from repository variables.

publish-darwin accepts assets from either producer. A successful build/upload is not publication: the workflow's literal required-core-asset and source-bound manifest gates govern release visibility. Missing Darwin output does not authorize a Linux-only publication bypass or a replay of accepted sibling uploads.

Validation

./scripts/ci-nix-peer-failover-smoke.sh
./scripts/darwin-cross-build-smoke.sh
./scripts/release-workflow-guard-smoke.sh

The peer-policy smoke includes owned dependency-mocked native-entry controls for immediate environment propagation, bootstrap refusal, credentials/trust, resource caps, linker isolation, signing arguments and lock release. Its temporary subject redirects only the fixed system-curl dependency and uses fake Nix/compiler/signer commands; this is source/argv evidence, not native Darwin, SDK, signing or live-cache acceptance.

Run real Darwin builds only on an operator-approved Darwin builder or through the configured release workflow. Shared Linux workers should not attempt to invent local Apple SDKs or run heavy emulators outside this first-party path.