Add Homebrew formula, cask, and packable simbroker npm CLI.

Why:
Strangers still needed a clone or a manual tarball extract to get
simbroker. The Alpha GitHub Release already had a CLI tarball, but there
was no brew or npm one-liner, and docs said those packages did not exist.

Changed:
Formula/simbroker.rb installs the v0.1.0-alpha.1 CLI tarball through
Homebrew. Casks/simulator-broker.rb installs Simulator Broker.app from
the signed, notarized GitHub Release zip Simulator-Broker-<version>.zip
when that zip is attached; it is not package:local. packages/simbroker
is a packable npm CLI with a bin field; scripts/package_npm.sh stages
the runtime without tests. The repo-root package stays private. README,
getting-started, status, SECURITY, CHANGELOG, and front-door tests
advertise brew and npm installs and drop the old not-yet wording. A
signed notarized app zip is not attached in this change.

Verification:
npm run agent:verify -- --profile spec-only --paths .agents/manifests/specs.yaml,.agents/verify/spec-only.yaml,.github/ISSUE_TEMPLATE/feature.yml,Casks/simulator-broker.rb,Formula/simbroker.rb,packages/simbroker/package.json,packages/simbroker/bin/simbroker.js,packages/simbroker/README.md,scripts/package_npm.sh,scripts/package_cli.sh,package.json,README.md,CHANGELOG.md,SECURITY.md,docs/getting-started.md,docs/status.md,docs/test/front-door.test.mjs,spec/project-structure.md,spec/README.md,spec/build-and-test.md --session-dir task-sessions/20260819-homebrew-notarized-npm
node --test docs/test/front-door.test.mjs
npm run verify:public-surface

Affected:
.agents/manifests/specs.yaml
.agents/verify/spec-only.yaml
.github/ISSUE_TEMPLATE/feature.yml
CHANGELOG.md
Casks/simulator-broker.rb
Formula/simbroker.rb
README.md
SECURITY.md
docs/getting-started.md
docs/status.md
docs/test/front-door.test.mjs
package.json
packages/simbroker/README.md
packages/simbroker/bin/simbroker.js
packages/simbroker/package.json
scripts/package_cli.sh
scripts/package_npm.sh
spec/README.md
spec/build-and-test.md
spec/project-structure.md

Refs:
https://github.com/fiveonecode/simulator-broker
https://github.com/fiveonecode/simulator-broker/releases/tag/v0.1.0-alpha.1
spec/project-structure.md

Session:
task-sessions/20260819-homebrew-notarized-npm

Author: VladimirBrejcha

.agents/manifests/specs.yaml

@@ -15,7 +15,11 @@ globs:
   - examples/**/.simulator-broker/*.json
   - spec/**
   - references/**
+  - Casks/**
+  - Formula/**
+  - packages/simbroker/**
   - scripts/package_cli.sh
+  - scripts/package_npm.sh
 owner: spec-steward
 required_skills:
   - harness-engineering
@@ -44,7 +48,11 @@ allowed_paths:
   - examples/**/.simulator-broker/*.json
   - spec/**
   - references/**
+  - Casks/**
+  - Formula/**
+  - packages/simbroker/**
   - scripts/package_cli.sh
+  - scripts/package_npm.sh
 forbidden_paths: []
 required_evidence:
   - structured-git-commit

.agents/verify/spec-only.yaml

@@ -4,7 +4,7 @@ covers_scenarios: []
 covers_boundaries: []
 commands:
   - id: spec-diff-check
-    run: git diff --check -- WORKFLOW.md AGENTS.md CLAUDE.md README.md LICENSE SECURITY.md CONTRIBUTING.md CODE_OF_CONDUCT.md CHANGELOG.md docs spec .agents agent-harness package.json package-lock.json .gitignore .github .codex script scripts references app broker-core client && git diff --cached --check -- WORKFLOW.md AGENTS.md CLAUDE.md README.md LICENSE SECURITY.md CONTRIBUTING.md CODE_OF_CONDUCT.md CHANGELOG.md docs spec .agents agent-harness package.json package-lock.json .gitignore .github .codex script scripts references app broker-core client
+    run: git diff --check -- WORKFLOW.md AGENTS.md CLAUDE.md README.md LICENSE SECURITY.md CONTRIBUTING.md CODE_OF_CONDUCT.md CHANGELOG.md docs spec .agents agent-harness package.json package-lock.json .gitignore .github .codex script scripts references app broker-core client Formula Casks packages && git diff --cached --check -- WORKFLOW.md AGENTS.md CLAUDE.md README.md LICENSE SECURITY.md CONTRIBUTING.md CODE_OF_CONDUCT.md CHANGELOG.md docs spec .agents agent-harness package.json package-lock.json .gitignore .github .codex script scripts references app broker-core client Formula Casks packages
   - id: public-front-door-check
     run: node --test docs/test/*.test.mjs
   - id: instruction-parity-check

.github/ISSUE_TEMPLATE/feature.yml

@@ -7,8 +7,10 @@ body:
     attributes:
       value: |
         Simulator Broker is **Alpha**, **macOS-only**, and needs **Xcode**.
-        It is maintenance-only infrastructure. There is no Homebrew formula,
-        notarized app, or npm package yet.
+        It is maintenance-only infrastructure. The CLI installs through
+        Homebrew or the packable `simbroker` npm package. A signed,
+        notarized operator app zip is not attached to the current Alpha
+        release.
 
         Maintainers may decline requests that add a feature, commercialization,
         or UX roadmap.

CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to Simulator Broker are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Added
+
+- Homebrew formula `Formula/simbroker.rb` installs the Alpha CLI tarball
+  (`brew install fiveonecode/simulator-broker/simbroker`).
+- Homebrew cask `Casks/simulator-broker.rb` installs `Simulator Broker.app`
+  from the signed, notarized GitHub Release zip `Simulator-Broker-<version>.zip`
+  when that zip is attached.
+- Packable npm CLI `packages/simbroker` (`npm run package:npm`) with a `bin`
+  field. The repo-root package stays private.
+
 ## [0.1.0-alpha.1] - 2026-08-18
 
 First tagged Alpha. The CLI, local `brokerd` service, and macOS operator app

Casks/simulator-broker.rb

@@ -0,0 +1,21 @@
+cask "simulator-broker" do
+  version "0.1.0-alpha.1"
+  sha256 :no_check
+
+  url "https://github.com/fiveonecode/simulator-broker/releases/download/v#{version}/Simulator-Broker-#{version}.zip"
+  name "Simulator Broker"
+  desc "macOS operator app for the local iOS Simulator control plane"
+  homepage "https://github.com/fiveonecode/simulator-broker"
+
+  depends_on macos: :ventura
+
+  app "Simulator Broker.app"
+
+  caveats <<~EOS
+    This cask installs Simulator Broker.app from the signed, notarized
+    GitHub Release zip Simulator-Broker-#{version}.zip. Produce that zip
+    with npm run package:distribution (Developer ID Application + notarytool),
+    using payload/app/Simulator Broker.app from the distribution bundle.
+    The current Alpha GitHub Release attaches the CLI tarball, not this zip.
+  EOS
+end

Formula/simbroker.rb

@@ -0,0 +1,22 @@
+class Simbroker < Formula
+  desc "Local iOS Simulator control plane CLI"
+  homepage "https://github.com/fiveonecode/simulator-broker"
+  url "https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.1/simulator-broker-0.1.0-alpha.1-cli.tar.gz"
+  sha256 "699695bc65a5bcb25b9c9b5d01494fcc3f25a40dcc90b8b5bf1ec61ea87a8522"
+  license "MIT"
+
+  depends_on :macos
+  depends_on "node"
+
+  def install
+    libexec.install Dir["*"]
+    (bin/"simbroker").write <<~SH
+      #!/bin/bash
+      exec "#{formula_opt_bin("node")}/node" "#{libexec}/client/bin/simbroker.mjs" "$@"
+    SH
+  end
+
+  test do
+    assert_match "simbroker", shell_output("#{bin}/simbroker --help")
+  end
+end

README.md

@@ -4,8 +4,9 @@ A local control plane so humans, AI agents, and CI jobs can share iOS Simulators
 on one Mac without stealing devices from each other.
 
 > **Alpha.** macOS only. Xcode is required to create or run iOS Simulators.
-> Interfaces can change. There is no Homebrew formula, notarized app, or npm
-> package yet.
+> Interfaces can change. Install the CLI with Homebrew or the `simbroker`
+> npm package. A signed, notarized operator app is not attached to this
+> Alpha release yet.
 
 [![Node tests](https://github.com/fiveonecode/simulator-broker/actions/workflows/ci.yml/badge.svg)](https://github.com/fiveonecode/simulator-broker/actions/workflows/ci.yml)
 
@@ -27,29 +28,42 @@ If you only ever use one simulator by hand, you may not need this yet.
 
 ## Use it
 
-From a clone, with Node.js 20+ on `PATH`:
+One-line CLI install on macOS, with Node.js 20+ still required at runtime:
+
+```bash
+brew install fiveonecode/simulator-broker/simbroker
+simbroker --help
+```
+
+```bash
+npm install -g https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.1/simbroker-0.1.0-alpha.1.tgz
+simbroker --help
+```
+
+From a clone:
 
 ```bash
 bash scripts/install_local.sh --cli-only
 command -v simbroker
 simbroker --help
 ```
 
-That copies the CLI runtime only. It does not run XcodeGen or build the macOS
-app. If Homebrew is installed, `simbroker` lands in `$(brew --prefix)/bin`.
-Otherwise the installer writes `~/.local/bin/simbroker` and one guarded
-login-shell PATH line. Open a new terminal if this shell still cannot resolve
-`simbroker`. `source .../env.sh` remains a fallback.
+The clone installer copies the CLI runtime only. It does not run XcodeGen or
+build the macOS app. If Homebrew is installed, `simbroker` lands in
+`$(brew --prefix)/bin`. Otherwise the installer writes `~/.local/bin/simbroker`
+and one guarded login-shell PATH line. Open a new terminal if this shell still
+cannot resolve `simbroker`. `source .../env.sh` remains a fallback.
 
-To try a tagged build without cloning, download
-`simulator-broker-<version>-cli.tar.gz` from
-[Releases](https://github.com/fiveonecode/simulator-broker/releases), extract
-it, and run `./bin/simbroker --help`. Node.js 20+ is still required.
+The Homebrew cask `fiveonecode/simulator-broker/simulator-broker` installs
+`Simulator Broker.app` from the signed, notarized GitHub Release zip
+`Simulator-Broker-<version>.zip`. That zip is not attached to the current
+Alpha release. Produce it with `npm run package:distribution` after Developer
+ID signing and notarytool notarization.
 
 Xcode is still required to create and run iOS Simulators. Alpha CLI tarballs
 are attached to
 [GitHub Releases](https://github.com/fiveonecode/simulator-broker/releases).
-There is no Homebrew formula or npm package yet.
+Extract a tarball and run `./bin/simbroker --help`.
 
 `simbroker` help and `simbroker doctor` print human-readable text by default.
 Pass `--json` for machine-readable payloads.

SECURITY.md

@@ -4,8 +4,10 @@
 
 Security fixes are considered for the current `main` branch and for the latest
 tagged Alpha (`0.1.0-alpha.1`). Older Alpha tags are not supported. The
-published artifact is the CLI tarball on GitHub Releases, not a Homebrew
-formula, notarized app, or npm package.
+published CLI artifacts are the GitHub Release tarball, the Homebrew
+formula that installs that tarball, and the packable `simbroker` npm
+package. A signed, notarized operator app zip is not attached to this
+Alpha release.
 
 ## Reporting A Vulnerability
 

docs/getting-started.md

@@ -9,8 +9,9 @@ A small public patch follows the public-patches track in
 [CONTRIBUTING.md](../CONTRIBUTING.md); it does not require the agent harness.
 
 > **Alpha.** macOS only. Xcode is required to create or run iOS Simulators.
-> Interfaces can change. There is no Homebrew formula, notarized app, or npm
-> package yet.
+> Interfaces can change. Install the CLI with Homebrew or the `simbroker`
+> npm package. A signed, notarized operator app is not attached to this
+> Alpha release yet.
 
 ## Prerequisites
 
@@ -21,6 +22,27 @@ A small public patch follows the public-patches track in
 Repo-owned macOS app entrypoints fail fast when `xcodegen` or `xcodebuild` is
 missing or unusable. The CLI-only installer does not call them.
 
+## Install the CLI with Homebrew
+
+```bash
+brew install fiveonecode/simulator-broker/simbroker
+command -v simbroker
+simbroker --help
+```
+
+That formula installs the tagged Alpha CLI tarball from GitHub Releases.
+
+## Install the CLI with npm
+
+```bash
+npm install -g https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.1/simbroker-0.1.0-alpha.1.tgz
+command -v simbroker
+simbroker --help
+```
+
+From a clone, `npm run package:npm` writes the same tarball. The repo-root
+package stays private.
+
 ## Install the CLI from this checkout
 
 ```bash
@@ -145,8 +167,12 @@ SIMBROKER_DISTRIBUTION_SIGNING_IDENTITY='Developer ID Application: Example (TEAM
 npm run package:distribution
 ```
 
-GitHub Releases attach the Alpha CLI tarball. A signed, notarized app is not
-published there yet.
+GitHub Releases attach the Alpha CLI tarball. The Homebrew cask
+`fiveonecode/simulator-broker/simulator-broker` installs
+`Simulator Broker.app` from `Simulator-Broker-<version>.zip` on that
+release. Produce the zip with `npm run package:distribution` after Developer
+ID signing and notarytool notarization. The current Alpha release does not
+attach that zip.
 
 ## Report a problem
 

docs/status.md

@@ -29,6 +29,10 @@ This Alpha already includes:
   harness-adoption, and public-surface checks
 - GitHub issue forms for install failure, bug, and feature, plus a light PR
   template that does not require a harness session
+- Homebrew formula `fiveonecode/simulator-broker/simbroker` for the Alpha CLI
+  tarball, a packable `simbroker` npm CLI (`npm run package:npm`), and a
+  Homebrew cask that installs `Simulator Broker.app` from the signed,
+  notarized GitHub Release zip when that zip is attached
 - local-debug packaging through `npm run package:local`
 - signed distribution packaging through `npm run package:distribution`
 - `simbroker project init` for `.simulator-broker/project.json`
@@ -64,4 +68,5 @@ node client/bin/simbroker.mjs simulators boot --alias ui-1
 
 ## Lower-priority public follow-through
 
-- Homebrew formula, notarized app, and npm package
+- Attach a signed, notarized `Simulator-Broker-<version>.zip` to GitHub
+  Releases so the Homebrew cask has a downloadable app artifact