[enderdev01]

Linked issue

Closes #19

What and why

• The menu asked for the Mac login password. StatusMenu.menuNeedsUpdate called
  vercel.hasCredentials, which read the Keychain on every menu update. The app is a
  non-activating panel, so macOS opened a Keychain prompt with no focused window: the first
  keystroke went nowhere and only dismissing it (Deny) and retrying worked.
  • The menu now reads a non-secret paired flag (mirrored in UserDefaults), so opening it never
    touches the Keychain.
  • Polling starts from applicationDidBecomeActive instead of launch, so any prompt it does raise
    has a focused window.
  • disconnect() activates the app before reading the Keychain.
• The hover list was a wall of deployment metadata. The expanded notch rendered every production
  deployment (up to 100) above the sessions. That section is gone, along with the now-unused
  DeploymentProgress view; the collapsed badge and the notification body keep the signal.

Changes

File	Change
Sources/AgentNotch/Infrastructure/VercelMonitor.swift	paired flag, no Keychain read for the menu, start on activation, activate before Keychain use
Sources/AgentNotch/App/AppDelegate.swift	start() moved to applicationDidBecomeActive
Sources/AgentNotch/UI/SessionListView.swift	Deployment section and parameter removed
Sources/AgentNotch/UI/NotchRootView.swift	Stops passing deployments to the list
Sources/AgentNotch/UI/AccentLine.swift	Removes the unused DeploymentProgress
Tests/AgentNotchTests/SessionListViewTests.swift	Drops the removed parameter
docs/*	UX rule 5, the plan and the security review (new finding F14) updated

How I tested it

• swift build -c release passes
• swift test passes (XCTest suites plus 7 Swift Testing tests)
• python3 scripts/check-strings.py passes (89 strings in 3 languages)
• Manually verified in the running app: not yet, since this agent cannot drive the UI. The menu path no longer reads the Keychain (by construction), and the list change is covered by the build.

Notes

• Ad-hoc signing caveat. The Keychain item is bound to the build that created it, so a rebuilt
  app may ask once. Reconnecting once from the installed build (or Always Allow) removes it for
  that build. Removing the prompt entirely would need a Developer ID signature.
• Removing the deployment list drops the only surface with project, repository, commit and author;
  those stay in the notification body. If a hover summary comes back, it should be one line for
  active deployments only, per docs/vercel-notch-ux.md.
• This needs an app release (0.3.5) to reach users; PR feat: polish the Vercel connection page and revoke on disconnect #18 (Worker page + revocation) is separate
  and only needs a wrangler deploy.