fix(install): ad-hoc code-sign on macOS so the binary isn't SIGKILLed (#312) (#315)

On Apple Silicon, an unsigned mimir binary is killed on launch (Killed: 9, no
output) by the macOS binary policy — even with no quarantine xattr. Since the
installer downloads an unsigned release binary, the very next step
(`mimir --version` verification, and the user's first `mimir doctor`) produced
no output and no error, with no path to diagnosis.

install.sh now runs `codesign --force --sign -` on the installed binary on
Darwin (guarded by `command -v codesign`; harmless on Intel), and prints the
manual fallback command if signing fails. README gains a macOS note with the
one-liner to re-sign after a manual `cargo build` + copy (signing is per-binary,
so it must be redone after each rebuild).

Closes #312.

Co-authored-by: tcconnally <hermes@perseus.observer>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

README.md

@@ -28,6 +28,16 @@ That's it. Mimir is installed to `~/.local/bin/mimir`. Start it:
 mimir serve --db ~/.mimir/data/mimir.db
 ```
 
+> **macOS note.** On Apple Silicon, an unsigned binary is killed on launch
+> (`Killed: 9`, no output) by the OS binary policy — even with no quarantine
+> attribute. The installer ad-hoc code-signs Mimir for you. If you build or copy
+> the binary yourself (`cargo build --release && cp target/release/mimir
+> ~/.cargo/bin/`), sign it once after each rebuild:
+>
+> ```bash
+> codesign --sign - "$(command -v mimir)"
+> ```
+
 Connect any MCP host (Claude Desktop, Cursor, Hermes Agent, Perseus, etc.):
 
 ```json

scripts/install.sh

@@ -84,6 +84,19 @@ mkdir -p "$BIN_DIR"
 chmod +x "$TMP_DIR/mimir"
 mv "$TMP_DIR/mimir" "$BIN_DIR/mimir"
 
+# macOS: ad-hoc code-sign so the binary is not killed on launch (#312). On Apple
+# Silicon an unsigned binary is SIGKILLed (Killed: 9) by the OS binary policy —
+# even with no quarantine xattr — so `mimir --version`/`doctor` would produce no
+# output. `codesign --sign -` applies an ad-hoc signature; harmless on Intel.
+if [ "$OS" = "apple-darwin" ] && command -v codesign >/dev/null 2>&1; then
+    if codesign --force --sign - "$BIN_DIR/mimir" 2>/dev/null; then
+        echo "→ Ad-hoc code-signed for macOS"
+    else
+        echo -e "${YELLOW}⚠  Could not code-sign. If 'mimir' is Killed: 9, run:${RESET}"
+        echo "     codesign --sign - $BIN_DIR/mimir"
+    fi
+fi
+
 # Check if BIN_DIR is on PATH
 if ! echo "$PATH" | tr ':' '\n' | grep -qxF "$BIN_DIR"; then
     case "$SHELL" in