@@ -72,7 +72,7 @@ jobs:
           if ! python3 -c 'import socket; s=socket.socket(); s.bind(("127.0.0.1",443)); s.close()'; then
             prefix=(sudo env "PATH=$PATH" GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory "GIT_CONFIG_VALUE_0=$PWD")
           fi
-          "${prefix[@]}" python3 scripts/check-v3-installed-consumer.py --output "$RUNNER_TEMP/package-evidence/matrix" --provider-prefix "$RUNNER_TEMP/package-evidence/prerequisites/provider" --pkg-config-dir "$(brew --prefix)/share/pkgconfig" --client-python "$RUNNER_TEMP/package-evidence/clients/bin/python" --node node --compiler "$V3_CXX" --cc "$V3_CC" --jobs 2
+          "${prefix[@]}" python3 scripts/check-v3-installed-consumer.py --output "$RUNNER_TEMP/package-evidence/matrix" --provider-prefix "$RUNNER_TEMP/package-evidence/prerequisites/provider" --pkg-config-dir "$(brew --prefix)/share/pkgconfig" --client-python "$RUNNER_TEMP/package-evidence/clients/bin/python" --node node --compiler "$V3_CXX" --cc "$V3_CC" --toolchain-prefix "$V3_PACKAGE_TOOLCHAIN" --jobs 2
       - name: Make privileged proof readable by artifact upload
         if: always()
         run: |
 
@@ -122,7 +122,7 @@ jobs:
         if ! python3 -c 'import socket; s=socket.socket(); s.bind(("127.0.0.1",443)); s.close()'; then
           prefix=(sudo env "PATH=$PATH" GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory "GIT_CONFIG_VALUE_0=$PWD")
         fi
-        "${prefix[@]}" python3 scripts/run-v3-release-ci.py platform --selection "$RUNNER_TEMP/selected/selected.json" --archive "$RUNNER_TEMP/selected/"libhttpserver-*.tar.gz --provider-prefix "$RUNNER_TEMP/prerequisites/provider" --client-python "$RUNNER_TEMP/clients/bin/python" --node node --compiler "$V3_CXX" --cc "$V3_CC" --output "$RUNNER_TEMP/platform" --pkg-config-dir "$(brew --prefix)/share/pkgconfig"
+        "${prefix[@]}" python3 scripts/run-v3-release-ci.py platform --selection "$RUNNER_TEMP/selected/selected.json" --archive "$RUNNER_TEMP/selected/"libhttpserver-*.tar.gz --provider-prefix "$RUNNER_TEMP/prerequisites/provider" --client-python "$RUNNER_TEMP/clients/bin/python" --node node --compiler "$V3_CXX" --cc "$V3_CC" --toolchain-prefix "$V3_PACKAGE_TOOLCHAIN" --output "$RUNNER_TEMP/platform" --pkg-config-dir "$(brew --prefix)/share/pkgconfig"
     - name: Make privileged proof readable by artifact upload
       if: always()
       run: |
 
@@ -72,6 +72,12 @@ def runtime(path):
         return bool(toolchain and location.is_relative_to(Path(toolchain).resolve()) and
                     any(fnmatch.fnmatch(location.name.lower(), pattern) for pattern in
                         ('libstdc++-*.dll', 'libgcc_s_*.dll', 'libwinpthread-*.dll')))
+    if platform.system() == 'Darwin':
+        toolchain = os.environ.get('V3_PACKAGE_TOOLCHAIN')
+        location = Path(path).resolve()
+        if (toolchain and location.parent == Path(toolchain).resolve() / 'lib/unwind'
+                and re.fullmatch(r'libunwind(?:\.[0-9]+)+\.dylib', location.name)):
+            return True
     trusted_roots = ('/libexec', '/usr/lib', '/lib', '/lib64', '/usr/lib64', '/usr/local/lib/gcc', '/opt/homebrew/Cellar/gcc', '/opt/homebrew/Cellar/llvm')
     return (any(fnmatch.fnmatch(Path(path).name, pattern) for pattern in RUNTIME)
             and any(Path(path).is_relative_to(Path(root)) for root in trusted_roots))
 
@@ -36,4 +36,4 @@ CPP
 "$toolchain_dir/clang++" --version > "$toolchain_dir/compiler.log"
 "$toolchain_dir/clang++" -std=c++20 "$toolchain_dir/cancellation.cpp" -o "$toolchain_dir/cancellation"
 "$toolchain_dir/cancellation"
-printf 'V3_CXX=%s\nV3_CC=%s\n' "$toolchain_dir/clang++" "$llvm_prefix/bin/clang" >> "$GITHUB_ENV"
+printf 'V3_CXX=%s\nV3_CC=%s\nV3_PACKAGE_TOOLCHAIN=%s\n' "$toolchain_dir/clang++" "$llvm_prefix/bin/clang" "$llvm_prefix" >> "$GITHUB_ENV"
@@ -85,6 +85,7 @@ def setUp(self):
         environment.start()
         self.addCleanup(environment.stop)
         os.environ.pop('V3_PACKAGE_PREREQUISITES', None)
+        os.environ.pop('V3_PACKAGE_TOOLCHAIN', None)
         self.tmp = tempfile.TemporaryDirectory()
         self.addCleanup(self.tmp.cleanup)
         self.root = Path(self.tmp.name)
@@ -212,6 +213,84 @@ def test_selected_native_provider_only(self):
         self.assertTrue(self.violations(graph, tls='no', surface='native'))
         self.assertTrue(audit.graph_violations(graph, 'strict', 'yes', 'native', self.policy, self.root / 'other-provider'))
 
+    def test_selected_darwin_unwind_accepts_observed_llvm_closure_only(self):
+        prefix = Path('/opt/homebrew/Cellar/llvm/23.1.0')
+        cxx = str(prefix / 'lib/c++/libc++.1.0.dylib')
+        abi = str(prefix / 'lib/c++/libc++abi.1.0.dylib')
+        unwind = str(prefix / 'lib/unwind/libunwind.1.0.dylib')
+        graph = {'nodes': [{'id': path} for path in ('consumer', cxx, abi, unwind)],
+                 'edges': [{'parent': parent, 'name': child, 'child': child} for parent, child in
+                           [('consumer', cxx), (cxx, abi), (cxx, unwind), (abi, unwind)]]}
+        with patch.object(audit.platform, 'system', return_value='Darwin'):
+            for selected in ('', str(prefix.parent / '22.0.0'), str(prefix)):
+                with self.subTest(selected=selected), patch.dict(os.environ, V3_PACKAGE_TOOLCHAIN=selected):
+                    errors = self.violations(graph)
+                    if selected == str(prefix):
+                        self.assertEqual([], errors)
+                    else:
+                        self.assertEqual([f'undeclared dependency (aggregate/strict): {parent} -> {unwind}'
+                                          for parent in (cxx, abi)], errors)
+
+    def test_selected_darwin_unwind_requires_canonical_directory_and_numeric_name(self):
+        prefix = self.root / 'llvm/23.1.0'
+        directory = prefix / 'lib/unwind'
+        directory.mkdir(parents=True)
+        target = directory / 'libunwind.1.0.dylib'
+        target.write_text('selected runtime')
+        alias = self.root / 'selected llvm'
+        alias.symlink_to(prefix, target_is_directory=True)
+        link = directory / 'libunwind.dylib'
+        link.symlink_to(target.name)
+        with patch.object(audit.platform, 'system', return_value='Darwin'), \
+                patch.dict(os.environ, V3_PACKAGE_TOOLCHAIN=str(alias)):
+            self.assertTrue(audit.runtime(str(target)))
+            self.assertTrue(audit.runtime(str(link)))
+            for path in (prefix / 'lib/libunwind.1.0.dylib', prefix / 'lib/c++/libunwind.1.0.dylib',
+                         prefix.parent / 'other/lib/unwind/libunwind.1.0.dylib',
+                         directory / '../libunwind.1.0.dylib', '/usr/lib/libunwind.1.dylib',
+                         directory / 'libunwind.bad.dylib',
+                         directory / 'libunwind.1.dylib.extra', directory / 'libunwind.1..0.dylib',
+                         directory / 'libcurl.4.dylib'):
+                with self.subTest(path=str(path)):
+                    self.assertFalse(audit.runtime(str(path)))
+            outside = self.root / 'libunwind.2.dylib'
+            outside.touch()
+            escape = directory / 'libunwind.2.dylib'
+            escape.symlink_to(outside)
+            self.assertFalse(audit.runtime(str(escape)))
+            target.unlink()
+            directory.rename(prefix / 'lib/sibling')
+            directory.symlink_to(prefix / 'lib/sibling', target_is_directory=True)
+            (directory / target.name).touch()
+            self.assertFalse(audit.runtime(str(directory / target.name)))
+
+    def test_selected_unwind_still_inspects_hashes_and_rejects_transitive_provider(self):
+        prefix = self.root / 'llvm'
+        directory = prefix / 'lib/unwind'
+        directory.mkdir(parents=True)
+        consumer, unwind, forbidden = self.root / 'consumer', directory / 'libunwind.1.dylib', self.root / 'libcrypto.dylib'
+        links = {str(consumer): [str(unwind)], str(unwind): [str(forbidden)], str(forbidden): []}
+        for path in links:
+            Path(path).write_text('inspected ' + path)
+        inspected = []
+        def inspect(path):
+            inspected.append(path)
+            return [(child, child) for child in links[path]]
+        with patch.object(audit.platform, 'system', return_value='Darwin'), \
+                patch.dict(os.environ, V3_PACKAGE_TOOLCHAIN=str(prefix)):
+            graph = audit.dependency_graph([str(consumer)], inspect)
+            self.assertEqual(set(links), set(inspected))
+            self.assertEqual({path: hashlib.sha256(Path(path).read_bytes()).hexdigest() for path in links},
+                             {node['id']: node['sha256'] for node in graph['nodes']})
+            self.assertEqual(['unselected native provider: ' + str(forbidden)], audit.graph_violations(
+                                 graph, 'strict', 'yes', 'aggregate', self.policy, self.root / 'provider'))
+            forbidden.rename(self.root / 'libmicrohttpd.dylib')
+            with self.assertRaisesRegex(audit.AuditError, 'unresolved dependency'):
+                audit.dependency_graph([str(consumer)], inspect)
+        with patch.object(audit.platform, 'system', return_value='Linux'), \
+                patch.dict(os.environ, V3_PACKAGE_TOOLCHAIN=str(prefix)):
+            self.assertFalse(audit.runtime(str(unwind)))
+
     def test_unknown_system_library_is_not_allowed(self):
         graph = {'nodes': [{'id': 'consumer'}, {'id': '/usr/lib/libsurprise.dylib'}],
                  'edges': [{'parent': 'consumer', 'name': '/usr/lib/libsurprise.dylib', 'child': '/usr/lib/libsurprise.dylib'}]}
 
@@ -4,12 +4,14 @@
 import argparse
 import importlib.util
 import os
+import re
 import shlex
 import shutil
 import sys
 from pathlib import Path
 import subprocess
 import tempfile
+import textwrap
 import unittest
 from unittest.mock import patch
 
@@ -31,7 +33,7 @@ def test_native_platform_matrix_receives_matching_provider_cli(self):
             args = argparse.Namespace(selection=selection, output=root / 'output',
                 archive=root / 'source.tar.gz', provider_prefix=root / 'provider',
                 compiler='clang++', cc='clang', make='make', jobs=2,
-                client_python='selected-python', node='node', pkg_config_dir=[], toolchain_prefix=None)
+                client_python='selected-python', node='node', pkg_config_dir=[], toolchain_prefix=root / 'selected llvm')
             observed = []
 
             class MatrixBoundary(Exception):
@@ -51,6 +53,8 @@ def command(argv, cwd, env, **kwargs):
                 with self.assertRaises(MatrixBoundary):
                     entrypoint.platform_proof(args)
             self.assertEqual(len(observed), 1)
+            argv = observed[0][0]
+            self.assertEqual(argv[argv.index('--toolchain-prefix') + 1], root / 'selected llvm')
             cli = 'openssl.exe' if os.name == 'nt' else 'openssl'
             self.assertEqual(observed[0][1]['V3_OPENSSL'], str(root / 'provider/bin' / cli))
             self.assertEqual(observed[0][1]['LD_LIBRARY_PATH'], str(root / 'provider/lib'))
@@ -97,6 +101,7 @@ def test_wrapper_selects_matching_library_and_preserves_arguments(self):
             self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
             selected = dict(line.split('=', 1) for line in Path(env['GITHUB_ENV']).read_text().splitlines())
             self.assertEqual(selected['V3_CC'], str(llvm / 'bin/clang'))
+            self.assertEqual(selected.get('V3_PACKAGE_TOOLCHAIN'), str(llvm))
             result = subprocess.run([selected['V3_CXX'], 'path with spaces.cpp', '-o', str(root / 'consumer')], env=env)
             self.assertEqual(result.returncode, 0)
             calls = [json.loads(line) for line in Path(env['INVOCATIONS']).read_text().splitlines()]
@@ -110,6 +115,47 @@ def test_wrapper_selects_matching_library_and_preserves_arguments(self):
             self.assertIn('-L' + str(llvm / 'lib/c++'), calls[-1])
             self.assertIn('-Wl,-rpath,' + str(llvm / 'lib/c++'), calls[-1])
 
+    def test_workflows_pass_selected_prefix_even_when_sudo_cleans_environment(self):
+        for workflow, job, entrypoint in (
+                ('v3-package-validation.yml', 'macos', 'scripts/check-v3-installed-consumer.py'),
+                ('v3-release-acceptance.yml', 'darwin', 'scripts/run-v3-release-ci.py')):
+            text = (ROOT / '.github/workflows' / workflow).read_text()
+            job_text = re.split(r'^  [a-z0-9_-]+:', text.split('  ' + job + ':', 1)[1], maxsplit=1, flags=re.M)[0]
+            lines = job_text.splitlines()
+            invocation = next(i for i, line in enumerate(lines) if entrypoint in line and '${prefix[@]}' in line)
+            start = next(i for i in range(invocation, -1, -1) if 'run: |' in lines[i])
+            block = textwrap.dedent('\n'.join(lines[start + 1:invocation + 1]))
+            for privileged in (False, True):
+                with self.subTest(workflow=workflow, privileged=privileged), tempfile.TemporaryDirectory() as directory:
+                    root = Path(directory)
+                    result, env, llvm = self.prepare(root)
+                    self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+                    selected = dict(line.split('=', 1) for line in Path(env['GITHUB_ENV']).read_text().splitlines())
+                    # Exercise the workflow's shell and argv; only native tools are substituted.
+                    python = root / 'tools/python3'
+                    python.write_text('#!' + sys.executable + '\n' + textwrap.dedent("""\
+                        import json, os, sys
+                        if sys.argv[1] == '-c':
+                            sys.exit(int(os.environ['PRIVILEGED']))
+                        with open(os.environ['CAPTURE'], 'w') as stream:
+                            json.dump({'argv': sys.argv[1:], 'toolchain_environment': os.environ.get('V3_PACKAGE_TOOLCHAIN')}, stream)
+                        """))
+                    python.chmod(0o755)
+                    sudo = root / 'tools/sudo'
+                    sudo.write_text('#!/bin/sh\nexec env -i CAPTURE="$CAPTURE" "$@"\n')
+                    sudo.chmod(0o755)
+                    result = subprocess.run(['bash', '-e', '-c', block], cwd=ROOT,
+                        env=dict(env, **selected, PRIVILEGED=str(int(privileged)), CAPTURE=str(root / 'captured.json')),
+                        capture_output=True, text=True)
+                    self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+                    captured = json.loads((root / 'captured.json').read_text())
+                    argv = captured['argv']
+                    self.assertEqual(argv[argv.index('--toolchain-prefix') + 1] if '--toolchain-prefix' in argv else None, str(llvm))
+                    self.assertEqual(argv[argv.index('--compiler') + 1], selected['V3_CXX'])
+                    self.assertEqual(argv[argv.index('--cc') + 1], selected['V3_CC'])
+                    if privileged:
+                        self.assertIsNone(captured['toolchain_environment'])
+
     def test_nonfinal_modes_do_not_receive_runtime_linker_flags(self):
         with tempfile.TemporaryDirectory() as directory:
             root = Path(directory)
 
@@ -0,0 +1,61 @@
+# FEATURE-ci-macos-unwind: selected Darwin LLVM unwind runtime
+
+Status: Implemented; local focused checks pass. Caller-owned Groundwork validation
+and finalization are pending. Native macOS package/archive execution remains
+CI / v3 PR owned. Base: `v3` at
+`6a1709daf6d5b51dac18a85c50030aeddd4cc570`.
+
+Mac package job120396472543 in run39948363870 resolved LLVM23 libc++ and
+libc++abi dependencies on `lib/unwind/libunwind.1.0.dylib`, then rejected both
+edges as undeclared during the first private strict aggregate audit. The
+original bounded diagnosis and native log remain unchanged at root
+`.debug/FEATURE-ci-macos-unwind/run-taafd3p6/`.
+
+The compiler selector now exports `V3_PACKAGE_TOOLCHAIN` from the same LLVM
+prefix that supplies its compiler and C++ runtime. Both Mac workflows pass
+that selection explicitly via the existing `--toolchain-prefix` option, so
+privileged execution retains it even when sudo filters the environment.
+Darwin runtime classification accepts only numerically versioned libunwind
+dylibs whose resolved parent is the canonical selected prefix's `lib/unwind`.
+Selected-prefix symlinks and dylib aliases to those files work; other directories,
+versions, malformed names, unrelated libraries and symlink escapes reject.
+Global runtime patterns, dyld-cache leaves and graph inspection remain unchanged.
+
+Action items:
+
+- [x] Create the isolated Groundwork worktree from the recorded v3 head;
+  preserve the Windows entropy repair, bauth worktree and other prior fixes.
+- [x] Capture failing actual graph-policy tests reproducing the two native edges
+  and failing compiler/workflow propagation tests before production edits.
+- [x] Export the selected LLVM prefix and pass it explicitly through both Mac
+  package and selected-archive workflow commands, including their sudo paths.
+- [x] Restrict Darwin unwind classification to the canonical selected directory
+  and numeric versioned basename; preserve strict provider and forbidden-library
+  checks, real-file inspection, hashes and transitive traversal.
+- [x] Refute trust-boundary doubts using canonicalization/escape/negative controls,
+  executed workflow shell blocks with a cleaned privileged environment, actual
+  release dispatcher forwarding, and graph/hash/provider regressions.
+- [x] Run affected audit, platform, package-workflow and release-workflow tests;
+  actionlint, Python compilation, Bash syntax and diff checks pass.
+- [x] Retain raw RED/GREEN logs, corrected fixture setup, doubts and command
+  results under root `.debug/FEATURE-ci-macos-unwind/repair-selected-prefix/`.
+- [ ] Caller: Groundwork validation and local finalization into v3.
+- [ ] CI / v3 PR: genuine native macOS package and selected-archive execution.
+
+Local verification: 40 installed-package policy/provenance tests, 7 platform
+execution tests, 4 package-workflow tests and 14 release-workflow contract tests
+pass. The new workflow test executes the actual Mac shell command blocks in
+both direct and simulated environment-cleaning sudo paths, with substituted
+native tool boundaries; it checks selected compiler and prefix arguments.
+These are policy/propagation fixtures, not native macOS installed-package proof.
+No full native baseline, CI rerun, Linux parity investigation, validation loop,
+merge or publication was performed. Native gates remain incomplete until CI.
+
+Project notes: Autotools/C++20 uses bootstrap, out-of-tree configure and make.
+This scripts-only task needs no dependency installation; focused tests use
+Python unittest and the workflow suite's existing PyYAML dependency. Platform
+fixtures substitute only native executable/process boundaries. Python files
+have no documented standalone linter; changed-file `py_compile`, Bash syntax,
+existing actionlint1.7.7 and `git diff --check` passed. Worktree branch/path came
+verbatim from the Groundwork identity helper; Git metadata writes required
+sandbox escalation. Agent memory was initially empty.