From acb9d8052b204a5e0505eb6f70b89d7c2e685b6b Mon Sep 17 00:00:00 2001
From: wangjia <809946525@qq.com>
Date: Sun, 6 Sep 2026 23:17:47 +0800
Subject: [PATCH] =?UTF-8?q?docs:=20runbook=20=E4=BF=AE=E6=AD=A3=20App=20ID?=
 =?UTF-8?q?=20=E8=83=BD=E5=8A=9B(=E4=B8=BB=20app=20=E9=9C=80=20System=20Ex?=
 =?UTF-8?q?tension)+=20=E6=94=B6=E6=95=9B=E4=B8=BA=202=20=E4=B8=AA=20App?=
 =?UTF-8?q?=20ID?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

实操验证补正:§1.2 原写 4 个 App ID 各勾 App Groups+Network Extensions,漏了主 app
的 System Extension 能力——缺它 macOS 主 app 的 Developer ID profile 不含
com.apple.developer.system-extension.install,构建报「profile doesn't include the
System Extension capability」。改为 2 个唯一 App ID(iOS/macOS 共用同串):主 app 需
App Groups+Network Extensions+System Extension,扩展需 App Groups+Network Extensions;
并说明改能力后 profile 变 Invalid 须重新生成。

背景:macOS Developer ID 签名链已本地端到端验证通过(build→重签→codesign 核验:
Yanmei AI LLC / 44WULXM6SV / com.yanmeiai.pangolin,零中国痕迹)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD
---
 docs/apple-account-migration-runbook.html | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/docs/apple-account-migration-runbook.html b/docs/apple-account-migration-runbook.html
index a99237b..0ef91a2 100644
--- a/docs/apple-account-migration-runbook.html
+++ b/docs/apple-account-migration-runbook.html
@@ -92,16 +92,14 @@
 <h3>1.1 记下 Team ID</h3>
 <p>Membership details → <b>Team ID</b> → 发我。</p>
 
-<h3>1.2 注册 4 个 App ID（Identifiers）</h3>
-<p>Certificates, IDs &amp; Profiles → <b>Identifiers</b> → ＋ → App IDs → App。逐个建：</p>
+<h3>1.2 注册 2 个 App ID（Identifiers）</h3>
+<p>Certificates, IDs &amp; Profiles → <b>Identifiers</b> → ＋ → App IDs → App。因 iOS/macOS 现共用同一 Bundle ID 字符串,<strong>只需 2 个唯一 App ID</strong>（各覆盖两端）：</p>
 <table>
 <tr><th>Description</th><th>Bundle ID（Explicit）</th><th>勾选的 Capabilities</th></tr>
-<tr><td>Pangolin macOS</td><td><code>com.yanmeiai.pangolin</code></td><td>App Groups、Network Extensions</td></tr>
-<tr><td>Pangolin macOS PacketTunnel</td><td><code>com.yanmeiai.pangolin.PacketTunnel</code></td><td>App Groups、Network Extensions</td></tr>
-<tr><td>Pangolin iOS</td><td><code>com.yanmeiai.pangolin</code></td><td>App Groups、Network Extensions</td></tr>
-<tr><td>Pangolin iOS PacketTunnel</td><td><code>com.yanmeiai.pangolin.PacketTunnel</code></td><td>App Groups、Network Extensions</td></tr>
+<tr><td>Pangolin（主 app）</td><td><code>com.yanmeiai.pangolin</code></td><td>App Groups、Network Extensions、<strong>System Extension</strong></td></tr>
+<tr><td>Pangolin PacketTunnel（扩展）</td><td><code>com.yanmeiai.pangolin.PacketTunnel</code></td><td>App Groups、Network Extensions</td></tr>
 </table>
-<p class="small">iOS 与 macOS 主 app 共用同一字符串 <code>com.yanmeiai.pangolin</code>——App ID 允许跨平台同串（一个 App ID 记录即可对两端生效）。若后台不让重复建，建一个即可，两端工程都指它。</p>
+<p class="small"><strong>主 app 三个能力缺一不可</strong>——尤其 <b>System Extension</b>：macOS 主 app 靠 <code>com.apple.developer.system-extension.install</code> 装载 sysext,少了它 Developer ID profile 不含该权限,构建报「Provisioning profile doesn't include the System Extension capability」。改了 App ID 能力后,相关 profile 会变 Invalid,须去 Profiles 重新 Generate + Download。扩展 App ID 只需 Network Extensions + App Groups。</p>
 
 <h3>1.3 创建 App Group</h3>
 <p>Identifiers → 右上下拉切到 <b>App Groups</b> → ＋ → 填 <code>group.com.yanmeiai.pangolin</code>（Description 随意）。回到上面 4 个 App ID，编辑其 <b>App Groups</b> capability → Configure → 勾上这个 group。</p>