@@ -128,11 +128,11 @@ A deep UX overhaul + correctness pass landed on top of the agentic core, all in
 M0→M4 is where you stop wanting to switch editors. These milestones are what make Atom++ *beat* the closed incumbents — grounded in what Cursor 2.0 and Windsurf actually ship in 2026, and scoped to what we already have. **Top bets, in leverage order:** (1) close the agent loop with self-verification; (2) turn BYO-key into a trust weapon — real token/cost accounting + visible/editable prompts; (3) add MCP so the agent inherits the ~10k-server tool ecosystem; (4) make the agent multi-provider (and thus local-model capable); (5) rebuild completion into true next-edit "Tab-to-Jump." *(S/M/L = effort, ●=high impact.)*
 
 **M5 — Close the loop & earn hands-off trust.**
-- **● Diagnostics-driven auto-verify loop** *(M)* — after edits land, auto-run a configurable verify command (typecheck/lint/test) + pull `vscode.languages.getDiagnostics` for touched files, feed failures back into the transcript, self-correct until green (bounded by a round budget). *The capability every 2026 source calls the defining trait of autonomous agents — and we already have `run_command` + diagnostics + a persistent loop, so this makes the agent "finish the job" instead of handing back broken code.*
+- **● Diagnostics-driven auto-verify loop** *(M)* — ✅ **DONE.** After edits land and the model goes to finish, Atom++ verifies its own work before handing back: pulls `vscode.languages.getDiagnostics` for the files it touched this run (NEW errors only — diffed against a pre-run baseline keyed by severity+message, so pre-existing/unrelated problems and line-shifts don't trigger a chase) and, if a verify command is configured, runs it through the live-terminal plumbing; failures are injected back as a synthetic turn so the agent self-corrects, bounded by `atompp.ai.verify.maxRounds` (re-entries) **and** `maxSteps`, abort-safe, shown as a live ⛨ verify card. A command that can't even run (missing npm script / not found / exit 127) is classified as a config problem — it warns the user and never loops the agent on it. New `verify.js` (pure, unit-tested: 24 + 8 + 13 cases) + settings `atompp.ai.verify.{enabled,command,maxRounds,includeWarnings}`. *The capability every 2026 source calls the defining trait of autonomous agents — turns the agent from "writes code" into "ships working code."*
 - **Background command execution** *(M)* — detect long-running commands (dev servers, watchers, `tail -f`) and run them **detached in the background** instead of blocking the agent loop: the agent gets an immediate "started on :3000 (running in background)" and continues, while the live terminal card keeps streaming and a Stop button stays available; the agent can read recent output on demand. *Today an approved server **blocks** the agent until you Stop it or the backstop timeout fires — the live-terminal + process-group kill (M4+) made stopping reliable, but the agent still can't proceed while a server runs. This is how Cursor/Windsurf handle servers, and it pairs with the diagnostics→fix loop (start server → run tests against it → fix → repeat).*
 - **● Workspace checkpoints / restore timeline** *(M)* — snapshot touched files per agent step, with one-click "Restore to here." *Cursor's checkpoints are explicitly "what makes people comfortable letting the agent make sweeping changes"; `reviewSession.js` already snapshots from disk, so this is mostly promoting it to a per-step stack.*
 - **Prompt transparency + editable system prompts** *(S)* — view and override the real `SYSTEM` prompts and see the exact context sent. *A stated PLAN pillar (§4, from Void), still unbuilt; a privacy/trust wedge against closed tools.*
-- **Real token + cost accounting** *(S)* — ✅ *context-usage half shipped*: `providers.js` now captures real Anthropic `usage` (input/output + cache tokens) from the stream, surfaced as an always-visible footer meter + a warning bar as the window fills (`atompp.ai.contextWindow`). *Remaining:* running $ spend + replace `lmProvider`'s length/4 estimate. *Cost opacity is the #1 criticism of BOTH Cursor and Windsurf — a no-backend editor showing exact per-message cost flips their biggest weakness into ours.*
+- **Real token + cost accounting** *(S)* — ✅ *context-usage shipped, Claude-Code-style*: `providers.js` captures real Anthropic `usage` (input/output + cache tokens); the footer now shows a **donut ring** that fills + recolors by pressure (accent → amber → red), and **clicking it opens a breakdown popover** (segmented bar + Messages / System prompt / Tools / Free-space rows with tokens + %), live-updating as the agent runs. *Remaining:* running $ spend + replace `lmProvider`'s length/4 estimate. *Cost opacity is the #1 criticism of BOTH Cursor and Windsurf — a no-backend editor showing exact per-message usage flips their biggest weakness into ours.*
 - **Ship-grade polish** *(S)* — ✅ *richer chat markdown shipped* (lists/tables/headings/links + diff coloring + codicons). *Remaining:* debug logging OFF by default; finish M3's Settings UI / theme studio / VS Code settings import.
 
 **M6 — Extensibility & multi-model parity.**
@@ -184,6 +184,7 @@ Give the agent a hot-swappable library of expertise it picks *implicitly* per ta
 
 **M8 — Mac polish + release prep.**
 Native menus, traffic-light integration, cold-start optimization; auto-update channel; final name + original logo + trademark check; notarized public/personal release. *Exit test: the app feels native and updates itself.*
+- **Signing & notarization** — full step-by-step runbook in [`docs/SIGNING-NOTARIZATION.md`](docs/SIGNING-NOTARIZATION.md): Apple Developer enrollment → *Developer ID Application* cert → notarization credential → inside-out hardened-runtime signing + Electron/V8 entitlements → `notarytool` notarize → `stapler` staple → verify. *Status: enrollment in progress (awaiting Apple, ~2 business days); `make-dmg.sh` stays ad-hoc until the cert lands. Repo integration (entitlements plist + `sign-notarize.sh`, env-gated so ad-hoc still works without a cert) is staged in the runbook's §10.*
 
 **M9 — Atom++ Cloud: accounts & sync. — strategic, opt-in, privacy-preserving.**
 A real sign-in account (like Cursor/Windsurf) that syncs your **settings, skills, keymaps, and profile** across devices — *without* surrendering Atom++'s differentiator. The hard line: **the AI path stays BYO-key / no-backend.** The cloud account never proxies model calls and never sees your provider keys; it only stores opt-in, end-to-end-encryptable config + your skill library. The "🖥 Local · Direct · BYO key" badge must stay literally true. *Built this session (client side):* the account avatar + sign-in/profile panel in the chat footer, a pluggable `atompp.cloud.endpoint`, the OAuth-callback URI handler (`…/auth/callback`), session token in SecretStorage — all honest about the backend not being live yet.
 
@@ -0,0 +1,214 @@
+# Atom++ — Code Signing & Notarization Runbook (macOS)
+
+How to turn the **unsigned / ad-hoc** Atom++ build into a **Developer-ID-signed, notarized, stapled**
+`.dmg` that launches cleanly on any Mac with no Gatekeeper warnings.
+
+> **Status (2026-06-28):** Apple Developer enrollment in progress (awaiting Apple support, up to ~2
+> business days). This runbook captures the full process so it's ready the moment the account + cert
+> land. Until then, `scripts/make-dmg.sh` keeps producing an **ad-hoc-signed** dmg (runs locally;
+> needs right-click→Open or `xattr -dr com.apple.quarantine` on other Macs).
+
+---
+
+## 0. Where we are vs. where we're going
+
+| | Today (ad-hoc) | Goal (Developer ID + notarized) |
+| --- | --- | --- |
+| Signature | `codesign --sign -` (ad-hoc) | `Developer ID Application: … (TEAMID)` |
+| Hardened runtime | no | **yes** (`--options runtime`, required to notarize) |
+| Entitlements | none | Electron/V8 JIT entitlements |
+| Notarized by Apple | no | **yes** (`notarytool`) |
+| Stapled ticket | no | **yes** (`stapler`) |
+| Other Macs | Gatekeeper blocks (right-click→Open) | **launches cleanly, no warning** |
+
+**The pipeline:** enroll → create *Developer ID Application* cert → create a notarization credential →
+sign inside-out with hardened runtime + entitlements → notarize the dmg → staple → verify.
+
+---
+
+## 1. Enroll in the Apple Developer Program  *(manual — only you can do this)*
+
+- **Cost:** $99 / year. **Time:** minutes to ~48h for approval.
+- Pre-req: your **Apple ID must have two-factor auth** enabled (<https://appleid.apple.com>).
+- Go to <https://developer.apple.com/programs/> → **Enroll**.
+- **Entity type:**
+  - **Individual / Sole Proprietor** — fastest; the app's signer shows your *personal legal name*.
+  - **Organization** — shows your *company name*, supports a team, but needs a **D-U-N-S number**
+    (free; can take a few days) and legal authority to enroll the entity.
+- Pay the **$99** (Apple Developer iPhone app or web) and wait for the approval email.
+
+> Recommendation for an indie/personal release: **Individual** now; convert to Organization later if needed.
+
+---
+
+## 2. Create the **Developer ID Application** certificate  *(manual)*
+
+⚠️ **Pick the exact right type** — distribution outside the App Store needs **"Developer ID Application"**:
+- NOT "Apple Distribution" (App-Store only).
+- NOT "Developer ID Installer" (that's for `.pkg`; we ship a `.dmg`, so we don't need it).
+
+**Via Xcode (easiest — also creates the private key):**
+1. Install **Xcode** (Mac App Store, free).
+2. Xcode → **Settings → Accounts** → add your Apple ID → **Manage Certificates…**
+3. **+** → **Developer ID Application**. The cert + private key land in your **login keychain**.
+
+**Verify (this exact identity string is what the build uses):**
+```bash
+security find-identity -v -p codesigning
+#  → "Developer ID Application: Your Name (TEAMID1234)"
+```
+Record your **Team ID** (`TEAMID1234`) and the full identity string.
+
+> Back up the cert+key: Keychain Access → My Certificates → right-click the Developer ID Application
+> cert → **Export** → save the `.p12` somewhere safe. Losing the private key means re-issuing.
+
+---
+
+## 3. Create a notarization credential  *(manual)*
+
+`notarytool` must authenticate to Apple. Pick one and store it once in the keychain:
+
+**Option A — App-specific password (simplest):**
+1. <https://appleid.apple.com> → **Sign-In and Security → App-Specific Passwords** → generate (name it `atompp-notary`).
+2. Store it:
+   ```bash
+   xcrun notarytool store-credentials "atompp-notary" \
+     --apple-id "you@example.com" \
+     --team-id  "TEAMID1234" \
+     --password "xxxx-xxxx-xxxx-xxxx"     # the app-specific password (not your Apple ID password)
+   ```
+
+**Option B — App Store Connect API key (best for CI):**
+- App Store Connect → **Users and Access → Integrations → App Store Connect API → +** → download the
+  `.p8`, note **Key ID** + **Issuer ID**.
+  ```bash
+  xcrun notarytool store-credentials "atompp-notary" \
+    --key AuthKey_XXXXXX.p8 --key-id "KEYID" --issuer "ISSUER-UUID"
+  ```
+
+Either way the saved profile is referenced later as `--keychain-profile "atompp-notary"`. No secret ever
+enters the repo.
+
+---
+
+## 4. Entitlements  *(in the repo — Electron/V8 needs these or it crashes under the hardened runtime)*
+
+Create `build/entitlements/atompp.entitlements.plist`:
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>com.apple.security.cs.allow-jit</key><true/>
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/>
+  <key>com.apple.security.cs.disable-library-validation</key><true/>
+  <key>com.apple.security.cs.allow-dyld-environment-variables</key><true/>
+</dict>
+</plist>
+```
+The same set is applied to the **helper apps** (GPU / Renderer / Plugin) — they inherit these so V8's JIT
+works in every process. (This mirrors what upstream VS Code / `@electron/osx-sign` apply.)
+
+---
+
+## 5. Sign — inside-out, hardened runtime  *(automated by `scripts/sign-notarize.sh`, to be added)*
+
+Electron apps **must be signed from the inside out** (every nested `.dylib`/`.framework` and each
+`*.app` helper first, the main bundle last). Plain `--deep` is unreliable for this — prefer
+[`@electron/osx-sign`](https://github.com/electron/osx-sign) which knows the correct order, or a manual
+loop. Key flags on every binary:
+```bash
+codesign --force --timestamp --options runtime \
+  --entitlements build/entitlements/atompp.entitlements.plist \
+  --sign "Developer ID Application: Your Name (TEAMID1234)" <path>
+```
+- `--options runtime` → hardened runtime (mandatory for notarization).
+- `--timestamp` → secure timestamp (mandatory; needs network).
+- Sign helpers/frameworks **before** the outer `Atom++.app`.
+
+**Verify the signature before notarizing:**
+```bash
+codesign --verify --deep --strict --verbose=2 "VSCode-darwin-arm64/Atom++.app"
+codesign -dv --verbose=4 "VSCode-darwin-arm64/Atom++.app"   # → "Authority=Developer ID Application…", "flags=…runtime"
+```
+
+---
+
+## 6. Notarize the `.dmg`
+
+Build the dmg (`scripts/make-dmg.sh`), then:
+```bash
+xcrun notarytool submit "Atom++-arm64.dmg" --keychain-profile "atompp-notary" --wait
+```
+- `--wait` blocks until Apple finishes (usually a few minutes) and prints **Accepted / Invalid**.
+- On **Invalid**, get the details:
+  ```bash
+  xcrun notarytool log <submission-id> --keychain-profile "atompp-notary"
+  ```
+
+---
+
+## 7. Staple the ticket
+
+```bash
+xcrun stapler staple "Atom++-arm64.dmg"
+```
+Stapling embeds the notarization ticket so Gatekeeper validates **offline** (no network on first launch).
+You can also staple the `.app` *before* building the dmg, then staple the dmg too.
+
+---
+
+## 8. Verify it will pass Gatekeeper on a clean Mac
+
+```bash
+xcrun stapler validate "Atom++-arm64.dmg"
+spctl -a -t open --context context:primary-signature -v "Atom++-arm64.dmg"
+#  → "source=Notarized Developer ID"  /  "accepted"
+```
+Best real test: copy the dmg to a **different Mac** (or a fresh user account), open it, drag to
+Applications, double-click — it should launch with **no warning**.
+
+---
+
+## 9. Troubleshooting
+
+| Symptom | Cause / fix |
+| --- | --- |
+| `notarytool` → **Invalid**, log says "not signed with a valid Developer ID" | Re-sign with the *Developer ID Application* identity + `--options runtime`. |
+| Log: "The executable does not have the hardened runtime enabled" | Missing `--options runtime` on some nested binary — re-sign inside-out. |
+| App crashes on launch ("killed", code 137 / SIGKILL) after signing | Missing JIT entitlements (§4) on the main app or a helper. |
+| "The signature does not include a secure timestamp" | Add `--timestamp` (needs network when signing). |
+| Gatekeeper still warns after notarizing | Forgot to **staple** (§7), or stapled the app but not the dmg. |
+| `errSecInternalComponent` during codesign | Keychain locked / wrong identity — `security unlock-keychain`; check `security find-identity`. |
+
+---
+
+## 10. Repo integration plan (to wire once the cert is installed)
+
+1. `build/entitlements/atompp.entitlements.plist` — the entitlements from §4 (tracked).
+2. `scripts/sign-notarize.sh` — Developer-ID signs inside-out (`@electron/osx-sign` or manual loop),
+   notarizes (§6), staples (§7), verifies (§8). **Gated on env vars** so it's a no-op without a cert:
+   - `ATOMPP_SIGN_IDENTITY` — e.g. `Developer ID Application: Your Name (TEAMID1234)`
+   - `ATOMPP_NOTARY_PROFILE` — e.g. `atompp-notary`
+3. `scripts/make-dmg.sh` — when `ATOMPP_SIGN_IDENTITY` is set, call `sign-notarize.sh` instead of the
+   ad-hoc `codesign --sign -`; otherwise behave exactly as today (ad-hoc, unnotarized).
+
+So a signed release becomes:
+```bash
+export ATOMPP_SIGN_IDENTITY="Developer ID Application: Your Name (TEAMID1234)"
+export ATOMPP_NOTARY_PROFILE="atompp-notary"
+./scripts/build-macos.sh && ./scripts/make-dmg.sh     # signs → dmg → notarize → staple → verify
+```
+
+---
+
+## Quick reference (once enrolled)
+
+```bash
+security find-identity -v -p codesigning                                   # confirm cert
+xcrun notarytool store-credentials "atompp-notary" --apple-id … --team-id … --password …
+# build + sign + notarize + staple (via the wired scripts):
+ATOMPP_SIGN_IDENTITY="Developer ID Application: … (TEAMID)" \
+ATOMPP_NOTARY_PROFILE="atompp-notary" ./scripts/make-dmg.sh
+xcrun stapler validate Atom++-arm64.dmg && spctl -a -t open --context context:primary-signature -v Atom++-arm64.dmg
+```