Run the alpha
with eyes open.

Crypto Signal Lab is a local research system with a native macOS shell and an iPhone companion. The private desktop alpha is now self-contained, but it is not yet an Apple-trusted public release.

The current build has a narrow support envelope. Checking it first avoids turning an architecture or provisioning mismatch into an installation mystery.

Use only the private DMG and checksum supplied through your alpha invitation. Do not download similarly named packages from a public package index.

1. Verify the private artifact

   Compare the DMG SHA-256 with the separately supplied manifest before mounting it. Keep both files together until installation is complete.

2. Copy the native app

   Mount the DMG and drag Signal Lab.app to Applications. The app bundle contains the runtime payload; no backend step comes first.

3. Install and start from the app

   Open Signal Lab, complete the scoped Gatekeeper approval if required, then choose Install Signal Lab. The app verifies its embedded manifest, creates the managed environment under your home directory, installs defaults, and starts the user service without root.

   DMG pathBest for invited testersComplete offline core install from one private disk image.

   Build pathFor contributors with Swift toolsRun bash scripts/install_desktop.sh to build and install both from source.

4. Approve the alpha build once

   The current shell is ad-hoc signed and not notarized. macOS will warn. Follow the scoped approval path in the next section; do not disable system-wide security.

   Approve this app safely →

Gatekeeper is doing its job: the current alpha proves that the app bundle has not changed since it was ad-hoc signed, but it does not prove an Apple-verified developer identity or notarization result.

Approve only this application

1. Verify the checksum.

   Compare the output with the separately supplied .sha256 file or invitation message.

   artifact verificationCopy

   $ shasum -a 256 "Signal-Lab-0.1.0-Developer.dmg"

2. Try the scoped Finder action.

   In Finder, Control-click Signal Lab.app, choose Open, then confirm Open if macOS offers it.

3. If macOS still blocks it, use Settings.

   Attempt the launch once, then open System Settings > Privacy & Security. In the Security area, choose Open Anyway for Signal Lab and authenticate locally.

4. Expect another prompt after replacement.

   A materially different app version may require a new approval. Recheck the checksum before approving it.

The standalone install starts with conservative defaults under your home directory. After relaunch, Setup & Devices shows the selected data root, sources, bootstrap state, and pairing controls.

The native app is a control surface around a local daemon and browser cockpit. Closing a window is not the same as stopping the research service.

What the system will and will not do

The companion is a remote view into your own desktop. It is not a hosted account and it cannot function without a reachable, paired local installation. Alpha users should receive it through TestFlight, never through source code, scripts, or a raw IPA.

Pairing expectations

• Keep the Mac awake and the Signal Lab service running.
• Use the same LAN for home-only reach, or a private Tailscale network for away access.
• Use only the HTTPS endpoint embedded in the signed pairing invitation.
• Approve the claim on the desktop after matching the short code.
• Revoke a lost or replaced phone from the desktop immediately.
• Never paste pairing payloads, tokens, or device credentials into a support message.

Alpha upgrades may change code, schemas, or packaging. Treat the local research database as valuable state and make the rollback path explicit.

$ siglab backup
$ siglab status
$ siglab repair --check-only

Most alpha failures fall into four boundaries: operating-system trust, missing backend installation, local service health, or phone reachability.

Signal Lab is local-first, not network-free. It contacts configured read-only data sources and notification adapters, while research state remains in the selected local application root.

• Never share a pairing payload, API token, webhook URL, private config, or raw keychain export.
• Never grant exchange write permission; the product does not require it.
• Keep the alpha artifact private unless the maintainer explicitly changes distribution terms.
• Verify checksums before first install and every update.
• Back up before changing versions, roots, or machine ownership.