Hi all, I’m seeing what looks like a bug with AppShortcutParameterPresentation and the Shortcuts app. Any time I provide an OptionsCollection to a shortcut so I can give it a nice category name and symbol in Shortcuts, it hides all other existing app shortcuts that my app has from the UI. I have created a sample that illustrates the problem. My app provides two App Shortcuts: A simple shortcut with no parameters. A shortcut with two parameters. Its Destination parameter uses AppShortcutParameterPresentation to generate “Home” and “Office” options in a separate section. When the second shortcut is present, the first parameterless shortcut disappears from the Shortcuts app. If I comment out the shortcut containing parameterPresentation, the parameterless shortcut appears again. Before commenting out: After commenting out the second shortcut: Here's the code: import AppIntents struct ParameterlessIntent: AppIntent { static let title: LocalizedStringResource = "Parameterless Intent" static let description = IntentDescription("Runs without asking for any parameters.") func perform() async throws -> some IntentResult { .result() } } struct ParameterizedIntent: AppIntent { static let title: LocalizedStringResource = "Parameterized Intent" static let description = IntentDescription("Runs with a destination and a copy count.") // The same provider is used by this parameter and by ParameterPresentation below. @Parameter( title: "Destination", optionsProvider: DestinationOptionsProvider() ) var destination: String @Parameter(title: "Copy Count", default: 1) var copyCount: Int static var parameterSummary: some ParameterSummary { Summary("Send \(\.$copyCount) copies to \(\.$destination)") } func perform() async throws -> some IntentResult { .result() } } nonisolated struct DestinationOptionsProvider: DynamicOptionsProvider { func results() async throws -> [String] { // Each generated App Shortcut option is a value for the Destination parameter. ["Home", "Office"] } } struct BugReproductionShortcuts: AppShortcutsProvider { static var appShortcuts: [AppShortcut] { // This parameterless shortcut should always appear in the Shortcuts app. AppShortcut( intent: ParameterlessIntent(), phrases: [ "Run the parameterless shortcut with \(.applicationName)" ], shortTitle: "Do I exist?", systemImageName: "1.circle" ) #warning("The presence of this shortcut causes the top one no longer appear in Shortcuts.app") AppShortcut( intent: ParameterizedIntent(), phrases: [ "Run the parameterized shortcut with \(.applicationName)" ], shortTitle: "Parameterized Shortcut", systemImageName: "2.circle", parameterPresentation: ParameterPresentation( for: \.$destination, summary: Summary("Send to \(\.$destination)") ) { // This title and symbol create a separate section in Shortcuts. OptionsCollection( DestinationOptionsProvider(), title: "Destination Shortcuts", systemImageName: "mappin.and.ellipse" ) } ) } } This code and reproduction is as of Xcode 27 Beta 6 and happens on older versions as well. Is there a known limitation with this or is this somehow expected behavior? If so, how can I mitigate this issue and provide a nice title for another shortcut, while keeping the old parameterless shortcuts present? Thanks!

I’m developing a factual snooker application using the on-device SystemLanguageModel on the current iOS 27, Xcode and macOS betas. The app allows someone to ask questions about professional snooker players. A tool searches my server and returns verified player data such as the player’s ID, name, nationality and date of birth. I have encountered a reproducible false-positive guardrail violation when the user asks about the professional snooker player Judd Trump. For example: Tell me about Judd Trump With the default model configuration, the request fails because the input or output is classified as potentially sensitive or unsafe. Using permissive content transformations solves the problem when generating a normal String: let model = SystemLanguageModel( useCase: .general, guardrails: .permissiveContentTransformations ) let session = LanguageModelSession( model: model, tools: [FindPlayerTool()], instructions: """ Answer factual questions about professional snooker players. Always use the supplied tool and only use verified tool data. Names returned by the tool are names of real snooker players and should be treated only as sporting entities. """ ) let response = try await session.respond( to: "Tell me about Judd Trump" ) This successfully calls the tool and produces a factual string response. However, I need guided generation because the model should be able to choose a combination of predefined UI components, such as: A player card A match card An event card A rankings table Explanatory text A simplified response type looks like this: @Generable struct CueQueryReply { let blocks: [ReplyBlock] } @Generable enum ReplyBlock { case playerCard(PlayerCardBlock) case text(TextBlock) } @Generable struct PlayerCardBlock { let playerId: Int let name: String let nationality: String let born: String } @Generable struct TextBlock { let text: String } The guided request is: let response = try await session.respond( to: "Tell me about Judd Trump", generating: CueQueryReply.self ) This reproduces the guardrail violation, even though the model is configured with: guardrails: .permissiveContentTransformations I understand that the documentation says permissive content transformations apply to string generation and that guided generation behaves like the default guardrails. However, this creates a difficult limitation for legitimate factual applications. “Judd Trump” is the real name of a professional snooker player, and the data is coming from a controlled, verified API. Renaming, removing or concealing the player is not a viable product solution. My questions are: Is this specific “Judd Trump” behaviour considered a guardrail false positive that should be reported through Feedback Assistant? Is there any supported way on iOS 27 to use permissive content transformations with guided generation? Can Dynamic Profiles, Dynamic Generation Schemas or another Foundation Models API change the guardrail behaviour for a controlled guided-generation request? Is there a recommended architecture for producing typed UI instructions while retaining the permissive behaviour available to string responses? Would generating only component types and verified IDs—for example .playerCard(playerId: 12)—be the recommended approach, provided the actual player data is resolved and displayed by SwiftUI? I understand the need for safety guardrails and am not attempting to disable the model’s underlying safety behaviour. I am trying to process a harmless, factual sporting name while using Foundation Models’ typed output features. The on-device model otherwise appears capable of handling this use case well, and keeping the experience on-device, private and free of external API dependencies is an important part of the product. I would appreciate any guidance from the Foundation Models team about whether this is expected behaviour, a beta issue, or something for which there is an intended iOS 27 solution.

Hey everyone, hoping to compare notes on something we have been chasing since beta 5. We have a Mac app that uses FoundationModels with @Generable types for structured output. Starting with macOS 27 beta 5, guided generation requests began logging tokenizer errors and our longer structured requests slowed from seconds to minutes. We are still seeing the same thing on beta 6 and beta 7. We filed it as FB24310823 on August 11 with a sysdiagnose and log captures. The signature is easy to check if you want to see whether your machine does it too. Stream the log while your app generates: log stream --predicate 'subsystem == "com.apple.tokengenerationcore"' --style compact On our machine the inference service (TGOnDeviceInferenceProviderService, category guided) prints these two lines in matched pairs, thousands of times: Generated an empty mask at recognizer index N allowedTokenIDs is empty. Something is likely wrong with the tokenizer Some numbers from beta 7 today: 9,008 of those pairs in about five and a half minutes. The errors start about one second into the first request after a fresh app launch. Requests that normally finish in 4 to 12 seconds take 77 to 170 seconds or longer. On beta 5 we measured decode at roughly 0.3 tokens per second on the worst requests. Short requests still finish at normal speed but they emit the same errors while they run, and the structured content they return looks degraded to us. On betas 5 and 6 we also saw repeated asset release errors for instruct_300m.tokenizer and the instruct_3b tokenizer saying the asset is not marked as in use. For what it is worth, a build that ran clean on beta 4 shows the same behavior on beta 5 and later with no app changes, and the same @Generable schema drives both the fast and the slow requests. But we know that does not rule out something on our side, and we would honestly be happy to learn this is our own bug since that would mean we can fix it. So two questions. Is anyone else seeing this since beta 5? And if you spot something we might be doing wrong on our end, sessions we should be recreating, schema patterns that stress the constrained decoder, anything at all, we would really appreciate the feedback. If it does turn out you are hitting the same thing, a Feedback referencing FB24310823 would help a lot. Thanks!

I'm seeing a reproducible difference in Foundation Models behavior between an iPhone 16 and iPhone 17 Pro Max, both running iOS 27.0 beta 6. My pipeline is roughly: Input → model generation → tool call → validation/correction → structured output Each test starts with a fresh model session. I run the same 50-case dataset on both devices with the same app build, prompt, tool, data, and execution order. The main difference is not just speed: the iPhone 16 consistently makes many more tool calls, which causes the session context to grow until some runs exceed the available context window. Both devices report a context size of roughly 4,096 tokens. Metric iPhone 16 iPhone 17 Pro Max Completed 30/50 49/50 Total tool calls 222 67 Mean calls/run 4.44 1.34 Max calls/run 22 2 Verified outputs 75.1% 91.0% The pattern is very consistent across repeated runs. On the 17 Pro Max, most requests converge after 1–2 tool calls. On the iPhone 16, some requests enter longer tool/correction loops and eventually fail because the context grows too large. I can probably mitigate this by limiting tool calls or changing the prompt, but I'd like to understand the underlying behavior. Is this difference expected across supported devices even on the same OS version? In particular: Can different on-device model variants be used depending on hardware? Is there a way to determine which model/profile a SystemLanguageModel session is using? Should tool-selection behavior be expected to remain reasonably consistent across devices? Would this be worth filing as a Foundation Models regression during the beta?

Environment iOS 27 Developer Beta iPhone17,3 Siri language: English Apple Intelligence availability/configuration differs depending on account/region state Observed behaviour Siri appears to expose behaviours normally associated with the newer intelligence architecture even when the Apple Intelligence experience is not fully enabled. Examples observed include: contextual follow-up questions across multiple turns; responses maintaining the subject of the previous request; different Siri visual/pulsing states depending on input; ChatGPT hand-off through Siri while preserving the original request; UI/settings references related to newer Siri intelligence capabilities; changes in Siri-related UI depending on Apple Account configuration. Reproduction example Invoke Siri. Ask a location/weather question. Ask follow-up questions without repeating the location or subject. Siri continues using the previous conversational context. Similar continuity can be observed across other queries. I have also observed differences in Siri UI and available settings after changing Apple Account configuration, while remaining on the same device and OS build. Question Is the contextual Siri architecture being deployed independently from the full Apple Intelligence feature set in iOS 27, or is this behaviour expected as part of the current beta implementation? I am particularly interested in understanding whether Siri’s contextual/runtime components and Apple Intelligence availability are now intentionally decoupled.

Está indexando en segundo, plano, pero no me aparece el 100, para Inhabilitar el software que se quede atrás, para evitar el cidrado extremo, no tengo la membresia debido a que estoy dado de alta como como Desarrolador, y Siri es la que encripta mis datos en la nube, con Intelligence, como mi teléfono está intervenido, es imposible que se libere el Xcode, sin embargo necesito el rotor del segundo plano, ya que la programación funcionó, y El sistema está trabajando al cien, solo necesito acceder al rotor del segundo plano

I've looked and looked and can't seem to find anything obviously wrong, so I'll ask here. Are NSTableViewAppIntentsDataSource protocol methods expected to be called? Have others had success with this? I've got an extremely trivial NSViewController subclass that conforms to NSTableViewDataSource, NSTableViewDelegate, NSTableViewAppIntentsDataSource. Things I've verified: The NSTableView is setup in a storyboard and the delegate and data source are connected to the view controller. In viewDidLoad while attached to the debugger I see this works. The table view includes a single row and appears populated when running the app. There seems to be no way to assign the appIntentsDataSource view controller in the storyboard, so that's assigned in code in viewDidLoad for the view controller. I can confirm it's correctly set in the data source methods for the table view. I have an AppEntity conforming type and AppIntentsPackage conforming type in the project. I can look at the actionsdata in the built product to confirm the entity is registered. Here's the entirety of the view controller: class ViewController: NSViewController, NSTableViewDataSource, NSTableViewDelegate, NSTableViewAppIntentsDataSource { @IBOutlet var tableView: NSTableView! func numberOfRows(in tableView: NSTableView) -> Int { print("numberOfRows(in:)") return 1 } dynamic public func tableView(_ tableView: NSTableView, objectValueFor tableColumn: NSTableColumn?, row: Int) -> Any? { print("tableView(_:objectValueFor:row:)") return NSObject() } override func viewDidLoad() { super.viewDidLoad() tableView.appIntentsDataSource = self } override var representedObject: Any? { didSet { // Update the view, if already loaded. } } dynamic public func tableView(_ tableView: NSTableView, appEntityIdentifierFor row: Int) -> EntityIdentifier? { print("ViewController.tableView(_:appEntityIdentifierFor:)") return EntityIdentifier(for: MyFancyEntity.self, identifier: "1234") } } Unfortunately, while attached with a debugger, ViewController.tableView(_:appEntityIdentifierFor:) just never seems to be called.

Apple's 8 June 2026 announcement states that developers in the EU will not be able to test or use the new Siri AI features in their apps for iOS 27, iPadOS 27 or watchOS 27. I am an EU-based developer building apps for users in multiple markets. App Intents Testing, simulator checks and unit tests can validate parts of an implementation, but they do not appear to replace end-to-end validation of Siri AI behaviour on supported iPhone and iPad hardware. What is Apple's supported route for an EU-based developer to validate the following for users in supported markets? • intent discovery and invocation • parameter resolution and follow-up interaction • error handling and confirmation flows • Siri's presentation and completion of an action • behaviour on supported physical devices Is an official remote-device environment, controlled developer testing mode or another Apple-supported arrangement available or planned? I am not asking for a way to bypass regional restrictions. I am looking for documented, compliant testing guidance for developers serving a global App Store. I have filed Feedback Assistant report FB24276767 about this testing-access issue. Apple source: https://www.apple.com/newsroom/2026/06/due-to-dma-siri-ai-delayed-in-eu-for-ios-27-and-ipados-27/

I keep running into rate limit issues that never go away while the app is running when trying to analyze images using Private Cloud Compute in iOS 27 Beta 6. After 20 or so images, I get a rate limit error from PCC, but the actual rate limit seems to come from SCML (see relevant log entries below). Once this happens, any attempted PCC requests result in an immediate rate limit error, no matter how long I wait, so long as the app is running. If I kill the app and relaunch, I no longer receive the rate limit error (unless, again I run several images through in succession). So it seems like once this state is triggered, you are stuck in it until you kill and relaunch the app. Has anyone else encountered this or have a workaround? I've filed a feedback already: FB24419603 Passing along Client rate limit exceeded, try again later in response to ExecuteRequest Passing along Client rate limit exceeded, try again later in response to ExecuteRequest systemPromptID failed for task textSafety: Rate limited. Wait a little bit and then try again.::Rate limited. Wait a little bit and then try again.: Client rate limit exceeded, try again later::Client rate limit exceeded, try again later; prompt template also not found: Rate limited. Wait a little bit and then try again.::Rate limited. Wait a little bit and then try again.: Client rate limit exceeded, try again later::Client rate limit exceeded, try again later End sanitizeText with error: Error Domain=com.apple.SensitiveContentAnalysisML Code=15 "SCML.CombinedTextSanitizerBackend.BackendError("SafetyGuardrailTextSanitizerBackend"): Rate limited. Wait a little bit and then try again." UserInfo={NSLocalizedDescription=SCML.CombinedTextSanitizerBackend.BackendError("SafetyGuardrailTextSanitizerBackend"): Rate limited. Wait a little bit and then try again., NSUnderlyingError=0x11a632ee0 {Error Domain=SensitiveContentAnalysisML.CombinedTextSanitizerBackend.BackendError Code=1 "SCML.CombinedTextSanitizerBackend.BackendError("SafetyGuardrailTextSanitizerBackend"): Rate limited. Wait a little bit and then try again." UserInfo={NSUnderlyingError=0x11a5dd380 {Error Domain=com.apple.GenerativeFunctionsFoundation.GenerativeError Code=1010000 "Rate limited. Wait a little bit and then try again."}, NSLocalizedDescription=SCML.CombinedTextSanitizerBackend.BackendError("SafetyGuardrailTextSanitizerBackend"): Rate limited. Wait a little bit and then try again.}}}

I’m trying to group my EntityPropertyQuery selection into sections as well as making it searchable. I know that the EntityStringQuery is used to perform the text search via entities(matching string: String). That works well enough and results in this modal: Though, when I’m using a DynamicOptionsProvider to section my EntityPropertyQuery, it doesn’t allow for searching anymore and simply opens the sectioned list in a menu like so: How can I combine both? I’ve seen it in other apps, but can’t figure out why my code doesn’t allow to section the results and make it searchable? Any ideas? My code (simplified) struct MyIntent: AppIntent { @Parameter(title: "Meter"), optionsProvider: MyOptionsProvider()) var meter: MyIntentEntity? // … struct MyOptionsProvider: DynamicOptionsProvider { func results() async throws -> ItemCollection<MyIntentEntity> { // Get All Data let allData = try IntentsDataHandler.shared.getEntities() // Create Arrays for Sections let fooEntities = allData.filter { $0.type == .foo } let barEntities = allData.filter { $0.type == .bar } return ItemCollection(sections: [ ItemSection("Foo", items: fooEntities), ItemSection("Bar", items: barEntities) ]) } } struct MeterIntentQuery: EntityStringQuery { // entities(for identifiers: [UUID]) and suggestedEntities() functions func entities(matching string: String) async throws -> [MyIntentEntity] { // Fetch All Data let allData = try IntentsDataHandler.shared.getEntities() // Filter Data by String let matchingData = allData.filter { data in return data.title.localizedCaseInsensitiveContains(string)) } return matchingData } }

A suspected RTL performance erratum in the Apple Neural Engine throttles DRAM weight streaming throughput down to 17–19 GB/s from the nominal 45–60 GB/s, whenever the total weight size is an integer multiple of 1 MiB. This was confirmed on M3 Macbook Air (2024) 24GB. 1 MiB is a common transfer size, and currently affects 7 of ANEMLL’s 15 baseline models. Avoiding the suspected problematic path in the kernel DMA's prefetch ring by splitting 1 MiB transfers into non-multiples of 1 MiB, directly increased Llama 3.2 1B token throughput from 10.0 to 24.3 tokens/s (DRAM usage from 24.7 to 60.0 GB/s), and Qwen3-8B from 1.36 to 2.97 tokens/s (DRAM usage from 22.4 to 48.7 GB/s). Please see writeup here: https://eiln.github.io/posts/ane-dma.html I'm looking to confirm that this behavior is reproducible on your side, and will provide the scripts in my plots.

Hi all, We're currently evaluating Private Cloud Compute (PCC) for a technical accuracy assessment. No production release or monetization is planned at this stage — our only goal is to test/evaluate the model. Per the official documentation, PCC access requires: Enrollment in the App Store Small Business Program Fewer than 2 million first-time downloads The Private Cloud Compute entitlement assigned to the account To complete Small Business Program enrollment, our Paid Applications Agreement is currently stuck at "User Information Pending", and we're being asked to submit a bank account and U.S. tax forms (Certificate of Foreign Status of Beneficial Owner / Substitute Form W-8BEN-E) before the agreement can go Active. Honestly, we're having a hard time accepting that submitting banking and revenue-related tax documentation is required when we have no intention of selling a paid app at all. The Small Business Program itself is meant to be a reduced-commission program for developers earning revenue through paid apps/IAP — using it as a gate for free AI model evaluation feels like a mismatch. On top of that, we're a Japan-based company, which raises the bar further. The required tax forms (W-8BEN-E etc.) are aimed at non-US entities and require pulling in our legal/finance teams just to prepare — a fair amount of overhead for what is, on our end, purely a technical evaluation. Before we go through the internal process of preparing this documentation, I wanted to confirm: Is there any path to obtain the PCC entitlement / Small Business Program status for evaluation purposes only, without completing the full Paid Applications Agreement (banking + tax forms)? Is submitting real banking and tax information a hard technical requirement of the Small Business Program itself (i.e., the Paid Apps Agreement cannot go Active without it), or can an account remain PCC-eligible while the agreement is "pending"? Is there an official Apple document (beyond the general Small Business Program / PCC pages) that explicitly confirms banking/tax submission is mandatory before PCC entitlement can be granted? We need something citable for internal approval. For non-US companies (e.g. Japan-based), has anyone gone through this purely for evaluation purposes? Is there any simplified path for foreign entities, or is the full W-8BEN-E process unavoidable? Any pointers to official documentation, or confirmation from anyone who has been through this, would be greatly appreciated — we need a clear, citable answer to justify preparing this documentation internally. Thanks in advance.

App intent has a perform method that is async and can throw an error, but I can't find a way to actually await the result and catch the error if needed. If I convert this working but non-waiting, non-catching code: Button("Go", intent: MyIntent()) to this (so I can control awaiting and error handling): Button("Go") { Task { do { try await MyIntent().perform() // 👈 } catch { print(error) } } } It crashes: AppDependency with key "foo" of type Bar.Type was not initialized prior to access. Dependency values can only be accessed inside of the intent perform flow and within types conforming to _SupportsAppDependencies unless the value of the dependency is manually set prior to access. Although it is invalid since the first version is working like a charm and dependencies are registered in the @main App init method and it is in the perform flow. So how can we await the result of the AppIntent and handle the errors if needed in the app? Should I re-invent the Dependency mechanism?

I ran into a gap in the MLXVLM → MLXLLM factory fallback and wanted to check whether this is expected behavior or something worth filing. Context: I maintain a Swift-native macOS agent built on MLX Swift, with a hardware-adaptive catalog of local models. I tried adding mlx-community/Qwen3.5-9B-4bit as a plain text model. Its config.json ships a full vision_config block — it looks like a multimodal config — but the actual checkpoint has no vision tower weights at all. It's genuinely text-only; the metadata just doesn't reflect that. ModelFactoryRegistry tries MLXVLM before falling back to MLXLLM. I expected that to fail cleanly and fall through, since there's no vision encoder to load. It doesn't. MLXVLM's Qwen35Configuration declares visionConfiguration as a non-optional property mapped to vision_config. Since the key is present in the raw config, decoding succeeds — there's nothing to catch at that stage. So MLXVLM proceeds to actually load the model as a VLM, and it crashes later, inside WiredMemoryUtils.tune(), because getRopeIndex() expects real vision-encoder dimensions to compute against, and there are none. Not a clean decode-time error I could catch — a runtime crash several layers past config parsing, in the RoPE indexing math. The workaround I ended up with is config-level surgery before the model reaches the factory at all: strip vision_config (and image_token_id / video_token_id) from the JSON first. With the key genuinely absent, Qwen35Configuration's decode throws DecodingError.keyNotFound as the fallback logic presumably intends, MLXVLM fails cleanly at that stage, and ModelFactoryRegistry falls through to MLXLLM correctly. That works, but it feels like a workaround rather than the intended path — the factory fallback seems to assume any failure will happen at decode time, and a config key that's present but semantically empty (no real vision weights behind it) skips that safety net entirely. Questions: Is there a more canonical/official way to detect whether a checkpoint actually has real vision tower weights, short of opening model.safetensors.index.json and counting vision_tower.* tensor names myself? (I've done exactly that for a different, genuinely multimodal Qwen VL checkpoint — 333 real vision tensors there vs. zero here — but it feels like something the loading path should be able to tell me.) Is the vision_config-present-but-empty pattern something the mlx-community conversion pipeline is aware of, or is this specific to how Qwen3.5-9B-4bit happened to get converted? Happy to share more logs/repro details if useful.

How can a local AI agent use MLX/Metal unattended while remaining confined to an authorized workspace? I am developing an AI-driven local media-processing workflow on an Apple-silicon Mac and am trying to understand the correct architecture for allowing it to run unattended without giving the AI agent unrestricted access to my primary personal computer. I am not a software engineer, so I may be missing an established macOS mechanism or using the wrong terminology. I would appreciate guidance from people familiar with MLX, Metal, sandboxing, and macOS security. What I am building I use OpenAI Codex as the local execution/software-development agent. The working system currently: ingests and verifies original video and still media while preserving immutable originals; performs visual semantic analysis and divides video into meaningful time-coded segments; separately analyzes spoken language rather than assuming audio and video are semantically equivalent; uses MLX Whisper locally on Apple silicon for time-coded speech transcription; stores visual and language semantics in a relational SQLite media catalog. These five stages are working. My current test corpus contains 148 original media files, 126 visual semantic segments, and 765 speech segments. The next stages are AI editorial construction from the semantic database and generation of instructions/scripts for a DaVinci Resolve rough cut. The security architecture I want Codex to operate autonomously within a deliberately bounded development environment. I do not want to solve this simply by granting an autonomous agent Full Disk Access to my primary personal Mac. The concern is ordinary fault containment. Codex generates and executes scripts, invokes applications and command-line tools, and manipulates files. A mistaken path or defective generated script should not have unrestricted consequences for the rest of my computer. I therefore separated AI execution from ordinary personal files. Codex is configured for Workspace Write access with explicitly authorized project roots. Canonical media resides on a separately authorized external SSD, and temporary AI working artifacts are kept separately. Ordinary Python and FFmpeg operations now run autonomously within these authorized areas. The problem The difficulty appears when the workflow invokes capabilities that cannot operate inside the ordinary Codex sandbox. The clearest example is MLX Whisper. I am using: MLX Whisper 0.4.3 mlx-community/whisper-small-mlx Apple silicon local transcription MLX Whisper works successfully and its transcription quality is sufficient for my semantic-retrieval application. However, MLX could not access Apple Metal/GPU execution from inside the ordinary Codex sandbox. Codex therefore requested permission to execute the transcription operation outside the sandbox. Once approved, MLX/Metal worked and the entire corpus was successfully transcribed. The processing therefore works, but the workflow cannot run genuinely unattended. A future operation should be able to run: new media → integrity verification → visual semantic analysis → MLX Whisper transcription → language semantic analysis → SQLite update → QA But if execution stops midway waiting for a human to click Allow, the pipeline is not operationally autonomous. What I have already tried I initially encountered permission problems even with ordinary file operations. I therefore: separated Codex work from ordinary personal documents; created dedicated project/work areas; explicitly authorized the required working roots; configured Workspace Write; separately authorized the external media repository; tested shell/Python and FFmpeg operations within those boundaries. Those changes worked. Routine Python and FFmpeg operations now run without approval prompts. The remaining issue occurs with MLX/Metal and some other application/runtime operations that require sandbox escalation. My question Is there a supported architecture for allowing a local AI agent to invoke MLX/Metal and other deliberately authorized development tools unattended, while still confining the agent to defined project/workspace boundaries rather than granting unrestricted access to the entire Mac? For example, should I be investigating: App Sandbox entitlements; a signed helper tool or XPC service; security-scoped resources; a dedicated executable with appropriate entitlements; a different method of launching MLX/Metal; or another macOS mechanism? In particular, can Metal/GPU access coexist with persistent bounded filesystem access without requiring interactive approval each time the AI invokes it? I am also unsure which security layer is actually responsible here: the Codex sandbox, macOS App Sandbox, TCC, executable/code-signing rules, Metal restrictions, or some interaction among them. If this kind of bounded unattended execution is intentionally not supported, that would also be useful to know. My alternative would be a dedicated Apple-silicon Mac containing only the AI-development environment and replaceable project data, where broader permissions would have a much smaller failure domain. I can provide the Codex configuration, exact successful and failing commands, directory/root configuration, macOS/hardware information, and sandbox diagnostics. I would particularly appreciate guidance on which security layer is causing the MLX/Metal escalation and what the supported architecture would be for this use case. Thank you.

As App Intents power multi-step workflows via Siri, Shortcuts, Spotlight, and Apple Intelligence, I would like to request a platform pre-action policy surface: Before intent perform(): input: intent_id, parameters, caller_agent_id, session_id, risk_hints output: allow | warn | deny | require_confirmation side: local audit_receipt Why this is needed Sandbox and TCC solve app isolation and one-time permission grants. Multi-step agentic loops introduce a different risk shape: Destructive tool selection from noisy natural language2. Uncapped retry / network loops3. Unauthorized data movement across app boundaries4. Financial / identity / Wallet actions that need dual control even when the app is already authorized Prompt-only or documentation-only guidance is not enforceable mid-loop. Apple-aligned properties On-device evaluation by default (privacy)- Complements TCC / sandbox â does not replace them- User-visible WARN / DENY with recoverable explanation- Optional Instruments-style â agent action timelineâ with gate verdicts Risk classes (map to entitlements mental model) | Class | Example | Default posture || --- | --- | --- || Read local | calendar, on-screen text | Allow / low friction || Cross-app write | paste into finance app | Warn or confirm || Destructive | delete, wipe, revoke | Deny or hard confirm || Network exfil | send sensitive context off-device | Deny until confirm || Financial / Wallet | transfer, mint pass | Always confirm | Related discussion There is already an excellent thread on pre-effectuation / execution finality for high-consequence App Intents. This request is complementary: a first-class, developer-visible pre-action hook (ALLOW / WARN / DENY / CONFIRM) at the intentâ action boundary, plus local audit receipts. Shipping reference (independent OSS control plane) I ship ThumbGate (npm thumbgate) â a local-first pre-action firewall used today for AI coding agents: PreToolUse / MCP interception, ALLOW/WARN/DENY, thumbs feedback â prevention rules. Public: https://thumbgate.ai · https://github.com/IgorGanapolsky/ThumbGate I will also file this as a Feedback Assistant Suggestion. Looking for: Confirmation this belongs under App Intents / Apple Intelligence2. Any existing API I missed for third-party or system-level pre-perform gates3. The right internal owner / Feedback area if this should go through a different channel Happy to share a one-pager with the risk taxonomy and proposed hook shape.

Environment: iPadOS 27 Beta (Developer Beta) iPad with Bluetooth Classic (iAP2/ExternalAccessory) + BLE active session App uses UIKit, WKWebView, scene-based lifecycle Problem: When the user invokes the new Siri AI by long-pressing the power button while our app is in the foreground with an active Bluetooth Classic session, we observe: No scene lifecycle callbacks fire — no sceneWillResignActive, no sceneDidEnterBackground, nothing. We confirmed by logging every UISceneDelegate method. Main thread / data processing threads are starved for ~2 seconds, causing a backlog of incoming Bluetooth data. Our real-time data processing latency jumps from ~105ms to over 2,300ms within 2 seconds of Siri activation. CADisplayLink / requestAnimationFrame callbacks show a ~935ms gap coinciding with the Siri overlay appearance, then irregular intervals afterward. The Bluetooth Classic transport (ExternalAccessory/iAP2) remains physically connected throughout — the issue is purely host-side processing starvation. What we've ruled out: BLE link degradation: firmware-side diagnostics confirm 100% data delivery, 0 lost packets during the incident Memory pressure from our app: our process memory stays flat; system-available memory drops ~14 units externally Questions: Is the absence of sceneWillResignActive when Siri AI activates on iPadOS 27 intended behavior, or a beta bug? The new UIApplication.systemPrefersReducedResourceUsage property (iPadOS 27 beta) — is this intended to signal system overlays like Siri consuming resources? Does the corresponding systemPrefersReducedResourceUsageDidChangeNotification fire when Siri activates? Are there recommended patterns for apps with real-time Bluetooth data processing to maintain thread priority during system overlays? We currently use default QoS for our data processing dispatch queues. The processing starvation causes the waveform display to degrade (appears as a connectivity issue to the clinician) even though the wireless link is healthy. We need either: A notification that a system overlay is active, so we can adjust our UI accordingly Guidance on maintaining processing priority during Siri AI activation Any community insight on workarounds would be highly appreciated. Thanks.

I've already used the new Siri for a few weeks but now it disappeared. The Siri app still exists but cannot use. Currently the Siri is the original Apple Intelligence. I went to Settings, Screen Time, Content & Privacy Restrictions, Siri, and the Siri AI (Beta) is grey cannot choose. Anyone knows how to fix it?

I would like to discuss a possible security architecture for Siri, Apple Intelligence, and App Intents where permission to invoke an app action is separated from permission for that specific action to become externally effective. For low-risk actions, existing authorization may be sufficient. However, for higher-consequence actions—such as payments, file export, message transmission, account changes, device control, or other irreversible operations—there may be value in introducing an additional execution-finality boundary. Problem Space An AI assistant may be authorized to invoke an App Intent, but that does not necessarily mean every resulting action should immediately become effective. For example: Siri may be allowed to invoke a payment-related intent, but not every amount or recipient should necessarily be executable. An app may expose a file-sharing intent, but a particular file or destination may fall outside the permitted scope. An AI-generated message may be validly created, but its final transmission may require additional execution-specific validation. Context, permission, destination, revocation state, or security state may change between intent generation and actual execution. The proposed distinction is: Permission to invoke an App Intent versus Permission for the specific resulting act to become externally effective Proposed Architecture A high-consequence action could first become a Candidate Act and remain in a Non-Effective State. Conceptually: Siri / Apple Intelligence ↓ App Intent ↓ Candidate Act ↓ Non-Effective State ↓ Protected Validation ↓ Scoped Execution Authority ↓ Finality Sink Verification ↓ External Effect If validation fails, expires, is revoked, is replayed, or becomes ambiguous: Default Denial → No External Effect Short Definitions Candidate Act The specific operation proposed by Siri, Apple Intelligence, or an app before it is allowed to create an external consequence. Non-Effective State A state in which the operation may be prepared, inspected, or evaluated but cannot yet produce its intended external effect. Protected Validation A validation step checking execution-relevant conditions such as app identity, user authorization, purpose, destination, scope, freshness, limits, revocation state, or device security state. Scoped Execution Authority Authority limited to the specific validated action rather than a broadly reusable permission. Finality Sink The consequence boundary where the action becomes externally effective—for example, a network transmission, file release, payment commit, database change, or physical-device action. Why This Could Be Useful This architecture could provide: separation of AI decision-making from final execution authority; fail-closed behavior for invalid or uncertain actions; resistance to replay or stale authorization; action-specific rather than broadly reusable authority; validation closer to the actual consequence boundary; stronger control for increasingly autonomous AI workflows. This would be intended as an optional mechanism for higher-consequence actions, not as a replacement for App Intents, existing user authorization, entitlements, sandboxing, or other Apple security mechanisms. Possible Interoperability Relevance This question may also become relevant as operating-system interoperability requirements evolve, including in the European Union under the Digital Markets Act. As third-party AI assistants and services gain deeper interoperability with operating-system features, there may be a need to distinguish between allowing an interoperating service to request an action and allowing that specific action to cross the final consequence boundary. A device-side execution-finality mechanism could potentially provide a technical middle layer: third-party AI services could request interoperable actions, while the operating system retains a neutral protected mechanism for validating the specific action immediately before it becomes externally effective. This may help explore how broader interoperability and strong device-side security could coexist without requiring unrestricted execution authority for either first-party or third-party AI assistants. I would be interested in whether Apple considers this type of consequence-boundary enforcement compatible with existing or future App Intents and interoperability architectures. Questions for Apple Engineers and Developers Does App Intents currently provide a supported mechanism for maintaining an action in a non-effective state until execution-specific authorization is verified? Where would Apple consider the correct enforcement point for such validation: App Intents, the host application, an OS-mediated service, or the actual consequence boundary? Is there an existing Apple framework or security primitive intended to provide this kind of action-specific, pre-effectuation execution authority? Would this model be relevant as Siri and Apple Intelligence gain the ability to perform more cross-app and agentic actions? Could an OS-mediated finality mechanism also provide a common security boundary for first-party and interoperating third-party AI assistants? I am particularly interested in understanding whether this should be considered an App Intents implementation pattern, an operating-system security concern, or a broader architectural mechanism for secure AI interoperability.

After updating my iOS and xcode to latest iOS 27 beta5 and xcode 27 beta5 all the system language model session calls with tool calls inclusion throwing Unrecognized system-instruction prefix ID: com.apple.fm_api.tool_calls_override error. The same code was working perfectly in iOS27 beta 4. Even the apple sample project OrigamiCraftingADynamicTutorialForAppleIntelligence failing with the same error when tool calls invoked. Anybody else facing similar issue or any workaround for this issue? sample code: struct GetRecordNotesTool: Tool { let name = "getRecordNotes" let description = "Fetches internal notes and returns Note_Title and Note_Content for up to 10 notes." @Generable struct Arguments { @Guide(description: "The API name of the module, e.g. Companies or Contacts") var module_api_name: String @Guide(description: "The unique record ID to fetch notes for") var record_id: String } func call(arguments: Arguments) async throws -> String { return "Fetched content" } }