# S7 Applications dossier

## Surface story

The bounded S7 registry contains 50 user-facing bundles: 47 at the top level of `/Applications`, one in `~/Applications`, and two in `/Applications/Utilities`. The separate `/System/Applications` probe returned 47 Apple OS bundles; that immutable OS surface is intentionally summarized, not itemized. Notable system apps in that excluded summary are Automator and Shortcuts, which can carry automation reach but are Apple-shipped OS components rather than user-install choices.

The healthy baseline is architecture: every compiled launcher checked by `lipo` was arm64, arm64e, or universal; none was x86_64-only. Anaconda-Navigator and ZAP are the two declared script/wrapper launchers, not missing architecture results.

⚠ Metadata coverage is constrained by observed command failures. The prescribed `defaults read` calls rejected almost every app Info.plist, `mdls` rejected every named bundle, and `spctl` returned an internal Code Signing subsystem error. Therefore this dossier does not invent app versions, last-used dates, staleness candidates, or spctl acceptance. `codesign`, `lipo`, `stat`, and the bounded embedded-LaunchAgents listing did return evidence. The S3 BTM census is also blocked: its authorized capture is missing and unprivileged `sfltool` is unauthorized.

## Security and maintenance findings

- Unsigned: **Anaconda-Navigator** and **ZAP**. Both need an explicit trust/provenance review before retention; the scan cannot establish whether either unsigned state is expected.
- No Rosetta tax: no Intel-only compiled app was found.
- Staleness threshold: the intended threshold is “no verified use in over 180 days *and* old content modification.” It cannot be applied because the named `mdls` reads failed. No app is labeled stale on the basis of file modification alone.
- Background presence: ChatGPT Classic embeds `com.openai.chat-helper.plist`. S1 also attributes background components to CleanMyMac, Docker, extFS for Mac, macOS InstantView, XQuartz, and Zoom. BTM records cannot be confirmed or denied until S3 receives the human capture.
- The duplicate pair is **WhatsApp 2.app** (Mac App Store signing) and **WhatsApp.app** (Developer ID). Keep one after confirming which installation holds the wanted account/session; the duplicate is the clearest prune candidate.
- VPN/network overlap deserves a product decision, not an automatic deletion: NordVPN, OpenVPN Connect, and Tailscale serve different network models; Wireshark, Transmission, Docker, extFS, and CleanMyMac are also access-sensitive and are marked for review.
- Confirmed S5 cask removals are available for 22 bundles: Caffeine, Claude, Codex, Docker, Figma, Godot, Google Chrome, Insomnia, iTerm, LM Studio, NordPass, NordVPN, OpenVPN Connect, Tailscale, The Unarchiver, VLC, Visual Studio Code, WhatsApp, Wireshark, XQuartz, ZAP, and extFS for Mac. All other rows carry a documented drag-to-Trash cleanup recipe.

## Self-use answers

1. **Unsigned or unnotarized:** Anaconda-Navigator and ZAP are unsigned. No broader unnotarized claim is supportable because `spctl` failed; investigate both unsigned bundles rather than treating the state as expected.
2. **Intel-only:** none. The two non-Mach-O launchers are explicitly classified as script/wrapper launchers.
3. **Long-unused candidates:** none can honestly clear the >180-day threshold while `mdls` is unavailable. WhatsApp 2 is a prune candidate because it duplicates WhatsApp, not because it is assumed stale.
4. **Background registrations:** ChatGPT Classic embeds the OpenAI helper. S1 cross-references CleanMyMac, Docker, extFS, InstantView, XQuartz, and Zoom components. Wolf should recognize each before a removal; S3 BTM state remains an explicit gap.
5. **Cask versus drag install:** the 22 confirmed casks are listed above; the other 28 have drag cleanup recipes in the inventory.
6. **Overlaps:** WhatsApp is the direct duplicate; Safari/Chrome/Firefox are overlapping browsers, and NordVPN/OpenVPN Connect/Tailscale are overlapping network tools with distinct likely roles. Review usage before consolidation.
7. **Less-obvious publishers:** Übersicht is Felix Hageloh; macOS InstantView is Silicon Motion; MarkChart is Mac App Store-signed under Team ID QFL3YR6JR6 but its workflow remains unknown; iTermBrowserPlugin is George Nachman’s companion bundle with unverified integration behavior.

## Per-item dispositions

| Item | Disposition | Reason |
| --- | --- | --- |
| Anaconda-Navigator | investigate | Unsigned script launcher; verify provenance. |
| Android Studio | keep | Signed Android development environment. |
| Anki | keep | Signed study application. |
| Burp Suite Community Edition | keep | Signed web-security tool; retain if used. |
| Caffeine | keep | Confirmed cask; simple wake-control utility. |
| ChatGPT Classic | investigate | Embedded background helper requires recognition. |
| Claude | keep | Confirmed cask desktop assistant. |
| CleanMyMac_5 | investigate | S1 ServiceManagement presence and broad maintenance reach. |
| Codex | keep | Confirmed cask coding application. |
| Docker | investigate | Background helper and container-system reach. |
| Figma | keep | Confirmed cask design client. |
| Firefox | keep | Signed browser; review only if browser consolidation is desired. |
| Godot | keep | Confirmed cask game engine. |
| Google Chrome | keep | Confirmed cask browser; overlap review optional. |
| Insomnia | keep | Confirmed cask API client. |
| LM Studio | keep | Confirmed cask local-model tool. |
| Logic Pro | keep | Apple audio workstation. |
| MarkChart | investigate | Exact workflow not verified. |
| NordPass | investigate | Password-manager data sensitivity. |
| NordVPN | investigate | VPN overlap and network privileges. |
| Obsidian | keep | Local notes application. |
| OpenVPN Connect | investigate | VPN overlap and profile handling. |
| Pages Creator Studio | investigate | Apple-signed bundle relationship unverified. |
| Raspberry Pi Imager | keep | Signed imaging utility. |
| Safari | keep | Apple browser; OS-related user-facing bundle. |
| Scrivener | investigate | Nonstandard bundle authority merits provenance review. |
| Slack | keep | Collaboration client. |
| Speedtest | keep | Network diagnostic utility. |
| Tailscale | investigate | Mesh-network access and VPN overlap. |
| The Unarchiver | keep | Confirmed cask archive utility. |
| Transmission | investigate | Network-facing BitTorrent client. |
| VLC | keep | Confirmed cask media player. |
| VMware Fusion | investigate | Virtualization and privileged-system integration. |
| Visual Studio Code | keep | Confirmed cask editor. |
| WhatsApp 2 | prune | Duplicates the separately installed WhatsApp.app. |
| WhatsApp | keep | Confirmed cask; decide only after checking the duplicate. |
| Wireshark | investigate | Packet-capture/network visibility. |
| Xcode | keep | Apple development environment. |
| ZAP | investigate | Unsigned script launcher; verify provenance. |
| calibre | keep | Signed e-book manager. |
| extFS for Mac | investigate | Filesystem driver integration and S1 agent. |
| iTerm | keep | Confirmed cask terminal emulator. |
| iTermBrowserPlugin | investigate | Exact companion integration unverified. |
| macOS InstantView | investigate | Silicon Motion tool and S1 helper; workflow unverified. |
| reMarkable | keep | Signed tablet synchronization client. |
| zoom.us | investigate | S1 login/hourly updater components. |
| Übersicht | keep | Signed desktop-widget framework. |
| Claude Code URL Handler | keep | Signed per-user URL handler. |
| Feedback Assistant | keep | Apple diagnostics-feedback tool. |
| XQuartz | investigate | S1 socket-activated X11 agent; keep if X11 software is needed. |