Last week I wrote about how Stillroom's build fails if the app links networking code . Stillroom is an encrypted vault for the Mac that Lis Shala and I make, and its whole promise is that it never goes online. The build check reads the compiled binary with otool and nm and refuses any socket, DNS or URL-loading call.

Alex Shev left a comment under that post that I kept thinking about. A build-time boundary makes the claim checkable, he said, but pair it with a test that actually tries the network, otherwise the exception becomes the new hidden dependency.

He was right, and the first run of that test proved it the same day.

What a link check can't see

The build check answers one question: can Stillroom's own code reach the network? It can't. But a Mac app doesn't only run its own code. Show a PDF and PDFKit draws it. Preview a file Stillroom has no viewer for and Quick Look does. Render an email and WebKit does.…