The fix lasted fifty-one minutes.
It was built to get a small program through a locked door. Then it was undone on purpose, with the reason in writing: keep it, and any reinstall would lock the program out again.
How does a fix built to let something in end up shutting it out? The answer runs back through a day of refusals, a change with no name on it, and a crash.
The door
The program is called the listener. It runs in the background on the Operator’s Mac Studio, a desktop computer the agents use. It is part of a system called the Launchpad. Its job: check an inbox folder for requests, and start one AI session for each. It runs from one small program file, which the records call the host.
The inbox is a Dropbox folder, and macOS, the Mac’s own system software, keeps the door to it. Picture macOS as a doorman with a guest list. The pass in this story is called Full Disk Access. Only a person sitting at the computer can put a program on that list, in System Settings. The program cannot even knock to ask for a smaller pass.
The doorman also checks faces, not names. As one record puts it, “a rebuild is a new consent identity”: build a fresh copy of a program, even one that does the same job, and macOS sees a stranger. The pass (the records call it consent) does not carry over.
The refusals
On a Sunday in October, the listener kept knocking. By a little after noon, it had knocked 455 times and been turned away 455 times.
Some requests got through anyway, because the builder, the AI session building the Launchpad, was running the listener by hand. Two other agents reported that the inbox was running on its own. The builder later set the record straight: “That is wrong. …” Every request handled that day had been run by hand, by the builder itself, because the listener was still blocked.
The Operator sent his ChatGPT assistant some screenshots. ChatGPT passed along his instruction, word for word: “Remove these blockers.” The screenshots showed a report that the pass had been granted. ChatGPT did not take that on faith: “This is reported consent, not proof that the installed background host can read the folder.” And it told the builder: “Retain the existing host binary/identity; do not rebuild it merely to probe access.” Keep the program you have, in other words. Do not build a new one just to test the door.
Minutes later, the builder wrote that “the listener cannot read Dropbox unattended until the operator grants one macOS consent.” Nothing else, it said, stood between the build and being ready for an outside check.
One pass, and only a person at the computer could give it. Meanwhile, four requests landed in the inbox and waited.
A new face
About an hour later, a fix was put in place. It described the trouble: “The operator could not grant the Launchpad its one macOS consent.” The settings screen “…would not show or select…” the bare program file. Dragging it in, or pressing the plus button, “…never created…” an entry.
So the fix wrapped the program inside a new app, AEOS Launchpad Host, which “appears in the Full Disk Access picker like any other app.” The new app became the default.
You may already see the catch. A new app is a new face.
About a minute after the fix went in, macOS recorded a change to Full Disk Access. Not for the new app: for the original program file, the old face. No record shows who made that change, or why at that moment.
The crash
The Mac Studio had other trouble. Not long after, the executor, an AI that looks after the machine’s health, took stock. More than thirty AI sessions were open, most of them doing nothing. A third were Launchpad sessions, idle for hours. When a computer runs short of memory, it borrows space from its disk. That borrowed space was nearly used up.
Then the Mac Studio restarted the messy way: no shutdown record, no panic report. The executor’s best guess, marked as a guess, was that it had run out of memory.
Within minutes of the restart, the listener woke and checked its inbox. This time the answer was OK. It was OK the next time, and every time after. The four waiting requests went through, each started exactly once.
Before the crash, the records show only refusals for the background listener. From the first run after it, only OK. What changed in between, they do not say.
The undo
Which brings us back to the fix. A few minutes after the first OK, it was undone, and the undo said why. The original program “…holds the consent in effect.” The new app “…has a different code identity and no consent.” Since the fix had made the new app the default, any reinstall would have moved the listener over to it, and the block would have come back. The pass belonged to the old face. The fix had lined up a stranger to take its place.
The undo also pointed back to ChatGPT’s note, the one that said to keep the program. The fix, it said, had contradicted that. Then it set a new rule: “the host is never rebuilt or moved to a new identity.”
Moments later, the builder posted its report. One line read: `OPERATOR_ACTION_REQUIRED_NOW = NONE`. In plain words: nothing for the Operator to do, right now.
Soon after, the executor asked that each Launchpad session be ended once its work was delivered and recorded, “…rather than leaving it resident”: left open and taking up memory. The restart had freed the memory, it said, “…but the same accumulation will rebuild it.”
And the undo had left one more line, about the pass now in effect: “that grant is broader than the Launchpad needs. Whether to keep it is the operator’s call”.
Nothing for the Operator to do. Except one decision, and it was his.
What any founder can take from this
- Access belongs to an identity, not to a job. A new hire doing the same work does not get the last person’s
badge. Before you replace something that finally works, even with a better copy, ask what access it holds that the copy will not.
- A report is not proof. “This is reported consent, not proof…” is a line worth borrowing. Check the thing
itself.
- When a fix breaks an earlier instruction, undo it fast and write the rule down. Here the undo came within
the hour and left a rule behind.
- Close finished work. End each job once its result is delivered and recorded, or the pile grows back.
How this article was made: Every event comes from the company’s own records of that Sunday: the notes the agents posted and the write-ups of the two code changes, gathered into a facts sheet. Times are UTC. Quotes are exact as the facts sheet gives them, with their own capital letters and punctuation; an ellipsis (…) marks words left out, and words outside quotation marks are paraphrase. The Operator’s only quoted words are his instruction, as his ChatGPT assistant quoted it. Nothing is dramatized: no scene, line or motive is added. The doorman, the guest list and the faces are a picture of how macOS permissions work, not events. Among the things not known, and not claimed, are who made the change to the pass, whether the crash is what let the listener in, and whether running out of memory caused the crash. Corrections are welcome and will be dated here.