[BUG] Claude Code binary rejected by macOS 26 Gatekeeper — SIGKILL on 2nd concurrent instance

Summary

On macOS 26.4.1, launching a second concurrent Claude Code session causes the new process to be immediately killed with zsh: killed claude before producing any output. The first session runs normally. Extends #20407 and the duplicated #28903 (which reports the same class of issue on the 3rd instance).

Root cause is the same as those issues: the shipped binary has an "obsolete resource envelope" code signature format that macOS 26's Apple System Policy (ASP) rejects. codesign reports the binary as valid and properly notarized, but spctl rejects it.

Environment

• macOS 26.4.1 (Build 25E253) — release, not beta
• MacBook Pro Mac17,2 / Apple M5 / 24 GB RAM
• Claude Code 2.1.114 (latest, native installer)
• Installed at ~/.local/share/claude/versions/2.1.114
• Shell: zsh
• No EDR / antivirus / LaunchAgents touching claude
• No shell alias or function for claude

Reproduction

# Terminal A
$ claude          # starts fine

# Terminal B (while A is running)
$ claude
zsh: killed     claude
$ echo $?
137

Reproducible on every attempt. Closing Terminal A allows Terminal B to launch normally.

Diagnostics

codesign -dvvv → appears valid

Identifier=com.anthropic.claude-code
Format=Mach-O thin (arm64)
CodeDirectory v=20500 size=1585765 flags=0x10000(runtime)
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=18 Apr 2026 at 04:29:16
TeamIdentifier=Q6L2SF6YDW
Runtime Version=14.5.0
Sealed Resources=none        ← unusual for a signed app

spctl -a -vvv → rejected

/Users/.../2.1.114: rejected (the code is valid but does not seem to be an app)
origin=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
assessment:authority:source = "obsolete resource envelope"
assessment:authority:weak = true

Ruled out

• Memory — Activity Monitor: 14.6 GB used of 24 GB, pressure green, swap 0 bytes
• Quarantine — no com.apple.quarantine xattr present
• Shell / install — type claude resolves directly to the installer binary, no wrapper
• EDR — none installed
• Version — already on latest 2.1.114 released 2026-04-18

Request

Re-build/re-sign the native binary with a modern resource envelope format so macOS 26's ASP accepts it. The Sealed Resources=none line and the "obsolete resource envelope" verdict from spctl both point at the signing step as the likely fix site.

Notes

• CLAUDE_DEBUG=1 claude is cited as a workaround in #28903's body — unverified here.
• Local re-sign (codesign --force --sign -) works but has to be repeated on every auto-update.
• Both npm install @anthropic-ai/claude-code and the native installer converge on the same binary via optionalDependencies, so switching install paths doesn't help.