From f0d015fc45e37902cdb9e8b6035c9dd37e2bd238 Mon Sep 17 00:00:00 2001
From: enricobuehler <buehler@unom.io>
Date: Sun, 5 Jul 2026 00:21:12 +0200
Subject: [PATCH] fix(apple/macos): drop the rejected audioanalyticsd sandbox
 exception
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

App Review declined 0.4.2 (3384) under guideline 2.4.5(i): the temporary
com.apple.security.temporary-exception.mach-lookup.global-name =
com.apple.audioanalyticsd exception "is not appropriate and will not be
granted." It had been added on the theory that CoreHaptics controller
rumble (RumbleRenderer / MenuHaptics) hard-crashes under the App Sandbox
without it, since the framework reaches the audio-analytics daemon over
Mach and the sandbox denies that global-name lookup.

Tested the theory directly on macOS with a real Xbox pad: a
CHHapticEngine start + full-intensity rumble in a genuinely enforced
sandbox (NSHomeDirectory redirected into the app container) with no
exception on the codesigned binary runs fine — no crash — even with a
live AVAudioEngine stream running concurrently. CoreHaptics tolerates
the denied lookup; the exception was never load-bearing.

So just remove it: CoreHaptics session rumble and menu haptics keep
working on macOS unchanged (no source change needed). DualSense stays on
its raw-HID path — a genuine Sony-motor gap — which needs no exception
either.

Resubmit requires a new build number and clearing the App Store Connect
App Sandbox entitlement-usage justification for this exception.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../apple/Config/Punktfunk-macOS.entitlements | 30 +++++++++----------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/clients/apple/Config/Punktfunk-macOS.entitlements b/clients/apple/Config/Punktfunk-macOS.entitlements
index 10dcd4f..877cc42 100644
--- a/clients/apple/Config/Punktfunk-macOS.entitlements
+++ b/clients/apple/Config/Punktfunk-macOS.entitlements
@@ -48,21 +48,21 @@
 	<key>com.apple.security.device.usb</key>
 	<true/>
 
-	<!-- Controller rumble via CoreHaptics: GCDeviceHaptics.createEngine → CHHapticEngine
-	     (GamepadFeedback's RumbleRenderer), and AVAudioEngine playback, reach the system
-	     audio-analytics daemon `com.apple.audioanalyticsd` over Mach. The sandbox denies that
-	     global-name lookup unless it's whitelisted here, and the framework's own precondition
-	     turns the denial into a HARD CRASH ("Process is sandboxed but
-	     com.apple.security.exception.mach-lookup.global-name doesn't contain
-	     com.apple.audioanalyticsd") the moment a controller's haptics engine starts. This
-	     temporary exception is the documented, App-Store-acceptable way to permit exactly that
-	     lookup — and ONLY that service (the key takes exact names, no wildcards). App Store:
-	     declare it in App Store Connect → App Sandbox Entitlement Usage Information ("CoreHaptics
-	     gamepad rumble contacts the system audio-analytics daemon"). -->
-	<key>com.apple.security.temporary-exception.mach-lookup.global-name</key>
-	<array>
-		<string>com.apple.audioanalyticsd</string>
-	</array>
+	<!-- NO mach-lookup temporary exception here — and none is needed. Build 0.4.2 (3384) shipped a
+	     `com.apple.security.temporary-exception.mach-lookup.global-name` = com.apple.audioanalyticsd
+	     exception on the THEORY that CoreHaptics controller rumble (CHHapticEngine — the session
+	     RumbleRenderer + MenuHaptics) hard-crashes under the App Sandbox without it, because the
+	     framework reaches the audio-analytics daemon over Mach and the sandbox denies that lookup.
+	     App Review REJECTED the exception under guideline 2.4.5(i) (review 2026-07-04). We then
+	     tested the premise directly on macOS: a CHHapticEngine start + full-intensity rumble on a
+	     real Xbox pad, in a genuinely ENFORCED sandbox (NSHomeDirectory redirected into the app
+	     container) with NO exception on the codesigned binary — and it ran WITHOUT crashing, rumble
+	     and all, even with a live AVAudioEngine stream running concurrently. CoreHaptics simply
+	     tolerates the denied audioanalyticsd lookup (it's telemetry, not a hard precondition). So
+	     controller rumble works fully sandboxed with none of these exceptions. Do NOT re-add one —
+	     it will be rejected again AND it buys nothing. (DualSense rumble separately goes over raw
+	     HID via device.usb/device.bluetooth — CoreHaptics genuinely doesn't drive Sony motors on
+	     macOS — but that path needs no exception either; see DualSenseHID.) -->
 
 	<!-- Keychain Sharing (unchanged from the shared file): a team-scoped access group so the
 	     punktfunk/1 client identity in the data-protection keychain is gated by the app's