ci: unblock remaining macOS and iOS workflows

.github/workflows/desktop-build.yml

@@ -18,7 +18,7 @@ jobs:
     environment: desktop-signing
     needs: changes
     if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.macos != 'false') }}
-    runs-on: macos-26-xlarge
+    runs-on: blacksmith-6vcpu-macos-26
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
         with:
@@ -192,7 +192,7 @@ jobs:
   verify-macos-desktop-artifacts:
     needs:
       - build-macos
-    runs-on: macos-26-xlarge
+    runs-on: macos-26
     permissions:
       contents: read
     steps:

.github/workflows/ios-dev-testflight.yml

@@ -22,7 +22,7 @@ jobs:
       github.ref == 'refs/heads/master' &&
       (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     environment: apple-signing
-    runs-on: macos-26-xlarge
+    runs-on: blacksmith-6vcpu-macos-26
     timeout-minutes: 240
     permissions:
       contents: read
@@ -126,7 +126,7 @@ jobs:
       (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     needs: build-ios-dev
     environment: apple-signing
-    runs-on: macos-26-xlarge
+    runs-on: macos-26
     timeout-minutes: 45
     permissions:
       contents: read

.github/workflows/mobile-build.yml

@@ -34,7 +34,7 @@ jobs:
       github.ref == 'refs/heads/master' &&
       (github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
       (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.ios != 'false')
-    runs-on: macos-26-xlarge
+    runs-on: blacksmith-6vcpu-macos-26
     permissions:
       contents: read
       id-token: write
@@ -114,7 +114,7 @@ jobs:
 
   verify-ios-artifacts:
     needs: build-ios
-    runs-on: macos-26-xlarge
+    runs-on: macos-26
     permissions:
       contents: read
     steps:
@@ -145,7 +145,7 @@ jobs:
       github.ref == 'refs/heads/master' &&
       (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     needs: verify-ios-artifacts
-    runs-on: macos-26-xlarge
+    runs-on: macos-26
     permissions:
       contents: read
     steps:
@@ -204,7 +204,7 @@ jobs:
       github.ref == 'refs/heads/master' &&
       (github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
       (needs.changes.result != 'success' || needs.changes.outputs.ios_onnx != 'false')
-    runs-on: macos-26-xlarge
+    runs-on: blacksmith-6vcpu-macos-26
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
         with:

.github/workflows/proxy-rust.yml

@@ -91,7 +91,7 @@ jobs:
             archive: maple-proxy-linux-x86_64.tar.gz
           - runner: ubuntu-24.04-arm
             archive: maple-proxy-linux-aarch64.tar.gz
-          - runner: macos-26-xlarge
+          - runner: blacksmith-6vcpu-macos-26
             archive: maple-proxy-macos-aarch64.tar.gz
           - runner: windows-2025
             archive: maple-proxy-windows-x86_64.zip

.github/workflows/release.yml

@@ -137,7 +137,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - platform: macos-26-xlarge
+          - platform: blacksmith-6vcpu-macos-26
             nix_shell: ci
             artifact_prefix: macos
           - platform: blacksmith-8vcpu-ubuntu-2404
@@ -152,7 +152,7 @@ jobs:
           persist-credentials: false
 
       - name: Select pinned Xcode
-        if: startsWith(matrix.platform, 'macos-26')
+        if: runner.os == 'macOS'
         run: python3 scripts/ci/select-xcode.py
 
       - name: Install Nix
@@ -476,7 +476,7 @@ jobs:
   build-ios:
     environment: apple-signing
     needs: classify-app-release
-    runs-on: macos-26-xlarge
+    runs-on: blacksmith-6vcpu-macos-26
     permissions:
       contents: write
       id-token: write
@@ -635,7 +635,7 @@ jobs:
             archive: maple-proxy-linux-x86_64.tar.gz
           - runner: ubuntu-24.04-arm
             archive: maple-proxy-linux-aarch64.tar.gz
-          - runner: macos-26-xlarge
+          - runner: blacksmith-6vcpu-macos-26
             archive: maple-proxy-macos-aarch64.tar.gz
           - runner: windows-2025
             archive: maple-proxy-windows-x86_64.zip
@@ -824,7 +824,7 @@ jobs:
     needs:
       - classify-app-release
       - build-tauri
-    runs-on: macos-26-xlarge
+    runs-on: macos-26
     permissions:
       contents: read
     steps:
@@ -960,7 +960,7 @@ jobs:
       - update-latest-json
       - verify-android-release-artifacts
       - verify-proxy-release-artifacts
-    runs-on: macos-26-xlarge
+    runs-on: macos-26
     permissions:
       contents: read
     steps:

docs/repository-workflows.md

@@ -74,14 +74,16 @@ persistent vendor disks or Docker builders are configured by these workflows.
 
 ## macOS runners and Apple toolchain
 
-Unsigned Research desktop/iOS PR builds and Agent release-binary jobs use
-explicit ARM64 `blacksmith-6vcpu-macos-26` runners. Other macOS jobs retain
-`macos-26` or `macos-26-xlarge` runners. Agent preview packaging and protected
-signing use standard GitHub `macos-26` runners to assemble prebuilt binaries.
-The Agent's final signed-package
-provenance identifies the GitHub packaging/signing job; Blacksmith is trusted
-for prebuilt binary integrity. Research
-desktop and iOS builds select stable Xcode 26.5, build `17F42`, from
+Research desktop/iOS builds, iOS ONNX cache warming, Agent release-binary jobs
+and native proxy macOS archives use ARM64 `blacksmith-6vcpu-macos-26` runners.
+Artifact verifiers, TestFlight uploads, and Agent preview packaging/protected
+signing use standard GitHub `macos-26` runners. Research signed builders retain
+their existing `desktop-signing` or `apple-signing` environment, so their
+provider receives that environment's secret context. Existing master pushes
+can build and upload independent Dev/Prod TestFlight artifacts after verification.
+The Agent's final signed-package provenance identifies its GitHub
+packaging/signing job; Blacksmith is trusted for prebuilt binary integrity.
+Research desktop and iOS builds select stable Xcode 26.5, build `17F42`, from
 [`scripts/ci/apple-toolchain.json`](../scripts/ci/apple-toolchain.json) through
 the shared selector, which aligns the runner's active `xcode-select` directory
 and `DEVELOPER_DIR`; the root Nix shell exports the same version and build

scripts/ci/test_select_xcode.py

@@ -150,6 +150,8 @@ def test_no_workflow_uses_retired_mac_os_and_every_native_selector_has_checkout(
                         self.assertNotIn("Xcode_26.5_beta", step.get("run", ""))
                         continue
                     selectors.append((path.name, job_id))
+                    if "if" in step:
+                        self.assertEqual(step["if"], "runner.os == 'macOS'", (path.name, job_id))
                     checkout = [s for s in steps[:index] if s.get("uses", "").startswith("actions/checkout@")]
                     self.assertEqual(len(checkout), 1, (path.name, job_id))
                     self.assertIs(checkout[0]["with"]["persist-credentials"], False)