Drive App Store Connect web residue via agentic browser (v1.64.2.0)

CHANGELOG.md

@@ -7,6 +7,19 @@
 > completion state and remaining P0 gates. No version bump or release claim is
 > made here while that status holds.
 
+## [1.64.2.0] - 2026-07-23
+
+**The App Store "manual gate" mostly isn't.**
+**gstack now offers to drive it, not describe it.**
+
+Apple's API refuses four things: creating the app record, generating the first API key, agreements, and banking/tax. Those are form fields on a website, not judgment, so the Apple release adapter no longer hands you a checklist for them. With your consent it drives the app-record form and the API-key generation on your logged-in App Store Connect session, saves the .p8 to a path you approve, and hands off only for the moments that are genuinely yours: Apple ID sign-in, two-factor, payment. The checklist survives as the fallback when no agentic browser is available or you decline.
+
+### Itemized changes
+
+### Changed
+
+- `references/APPLE-RELEASE.md` (ship tree): App Store Connect web residue routes through the agentic-browser drive in `THIRD-PARTY-ACTIONS.md` first — app record, .p8 key generation with download-to-approved-path — with sign-in/2FA/payment as explicit user-performed hand-offs. Manual checklist demoted to fallback.
+
 ## [1.64.1.0] - 2026-07-23
 
 ## **A hackathon plan now gets five questions, total.**

VERSION

@@ -1 +1 @@
-1.64.1.0
+1.64.2.0

package.json

@@ -1,6 +1,6 @@
 {
   "name": "gstack",
-  "version": "1.64.1.0",
+  "version": "1.64.2.0",
   "description": "GStack 2 \u2014 six portable Agent Skills with an optional host-neutral runtime.",
   "license": "MIT",
   "type": "module",

scripts/gstack2/generate-skill-tree.ts

@@ -681,7 +681,7 @@ The App Store Connect API covers nearly all remaining work; drive it from a CLI,
 
 Through the CLI: description, keywords, and localizations; screenshot upload per required device size; TestFlight groups and testers as an intermediate distribution before review; attaching the uploaded build to the version; Submit for Review; and review-status monitoring afterward. Submission is an external effect like the upload: run it through the durable state wrapper with a key like \`appstore.submit.<bundle-id>.<version>\`.
 
-The API cannot create the initial app record (name, bundle ID, SKU, primary language), accept agreements, or configure banking and tax; those stay on the App Store Connect website, offered through \`references/THIRD-PARTY-ACTIONS.md\` or as a short manual checklist. The same fallback applies to any individual field the chosen CLI cannot set. After submission, report that App Review typically answers within a day or two and close the run; review outcome is not a gate this workflow can hold open.
+The API cannot create the initial app record (name, bundle ID, SKU, primary language), generate the first API key, accept agreements, or configure banking and tax; those live on the App Store Connect website — but they are form fields, not judgment, so never present them as a manual gate without first offering the agentic-browser drive per \`references/THIRD-PARTY-ACTIONS.md\`. With consent, drive the app-record form and the Users and Access → Integrations key generation directly on the user's logged-in session, saving the downloaded \`.p8\` to a user-approved path outside the repository. The only steps that are genuinely the user's are Apple ID sign-in, two-factor confirmation, and payment; hand off for those moments and resume. A manual checklist is the fallback when no agentic browser is available or the user declines. The same applies to any individual field the chosen CLI cannot set. After submission, report that App Review typically answers within a day or two and close the run; review outcome is not a gate this workflow can hold open.
 `;
 }