---
date: 2026-08-05
type: area
tags: [macos, privacy, migration, signing]
---

# Mac Privacy Migrations

## Context
Mac mini is sole private/browser host per AGENTS.md. All browser automation, private state, and signing runs only on Mac mini M4 (.102). iMac is kids-only.

## Rules (user approved)
- Batch work for one GUI signing wave
- Make redacted Gitea backup first (adolforeyna/*)
- Never commit credentials
- Xcode Automatic Signing, not ad-hoc codesign — avoid fragile codesign calls
- No browser automation on iMac — Mac mini only

## Migration Checklist
- [ ] Gitea backup (redacted) before privileged migrations
- [ ] Batch signing items (one wave)
- [ ] Xcode managed signing target
- [ ] Verify Mac mini private host: GW :8642, MCP, browser CDP :9222, visible profile Hermes

## Related
- Projects: reyna_cli_browser_control.md, paseo_centralized_agents_2026.md
- Hermes migration audit: areas/operations/hermes_migration_macmini_2026-08-02.md
- Apple Mail local: areas/operations/apple_mail_local_read_research_2026-08-03.md
- Network inventory: areas/network/devices_inventory.md

## Infra Map Reminder
- .150 iPhone MCP: play_audio_base64, Voicebox, mic, camera
- .102 Mac mini M4: GW API :8642, MCP server, image gen, calendar/contacts
- .110 FamReynaServer: Pi-hole, Instatic :3002/:3005, Immich, Docker host
- .126/.128 aeropi5: legacy Hermes gateway (now Mac mini)

[[Areas]] | [[Index]]