From 1e0f7a17a4d4a2c9bc2b8b3c14b2454129d36e2f Mon Sep 17 00:00:00 2001 From: Sinabina Date: Thu, 23 Jul 2026 17:26:07 -0700 Subject: [PATCH 1/3] feat(gstack2): design Apple release around the session-only baseline user Baseline story: Apple ID + just-paid membership, no .p8, no app-specific password. Upload/metadata/TestFlight/submit run on FASTLANE_SESSION alone (documented fastlane auth); storefront CLI is picked by credential world (session -> deliver, key -> asc), one tool per release. Co-Authored-By: Claude Fable 5 --- scripts/gstack2/generate-skill-tree.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/gstack2/generate-skill-tree.ts b/scripts/gstack2/generate-skill-tree.ts index 23369a0d32..80f6c9c7f8 100644 --- a/scripts/gstack2/generate-skill-tree.ts +++ b/scripts/gstack2/generate-skill-tree.ts @@ -662,7 +662,7 @@ Resolve and verify before archiving. Fix what the printed mutation boundary auth 1. Archive the Release configuration: \`xcodebuild archive -scheme -destination 'generic/platform=iOS' -archivePath .xcarchive\` (substitute the actual platform). 2. Author an export-options plist with method \`app-store-connect\`. Prefer \`destination: upload\`, which validates and uploads in one supported step; \`destination: export\` plus the Transporter app is the fallback. -3. Authenticate with an App Store Connect API key when one exists (\`-authenticationKeyPath\`, \`-authenticationKeyID\`, \`-authenticationKeyIssuerID\`). The \`.p8\` key is a secret under the \`THIRD-PARTY-ACTIONS.md\` rules: stored outside the repository, referenced by path, never echoed. No \`.p8\` is NOT a blocker: Apple ID session auth uploads and submits without one — machine-level fastlane \`deliver\`/\`pilot\` with \`FASTLANE_SESSION\` (minted once by \`fastlane spaceauth\`) and \`FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD\` from the environment. Both are env credentials, never argv, never echoed, and fastlane here is a consent-gated machine tool, still never a project dependency. +3. The baseline gstack user has an Apple ID and a just-paid membership — no API key, no app-specific password. That user uploads on session auth: machine-level fastlane \`deliver\`/\`pilot\` with \`FASTLANE_SESSION\`, minted once by \`fastlane spaceauth\` (one 2FA entry, automatable via an approved local code source; per fastlane's documented auth, the session ALONE suffices for binary upload — \`FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD\` is an alternative, not a requirement). The session is an env credential: never argv, never echoed, re-minted by the same command when it expires. fastlane is a consent-gated machine tool, still never a project dependency. Only when the user separately holds an App Store Connect API key, prefer \`xcodebuild -exportArchive\` with \`-authenticationKeyPath\`/\`-authenticationKeyID\`/\`-authenticationKeyIssuerID\`; the \`.p8\` is a secret under the \`THIRD-PARTY-ACTIONS.md\` rules: stored outside the repository, referenced by path, never echoed. 4. The upload is an external effect: run it through the durable state wrapper with a key like \`appstore.upload..\`. Never re-upload on ambiguity; inspect App Store Connect for the build first. ## Store assets @@ -677,13 +677,13 @@ When preflight finds a missing icon, or the storefront step needs screenshots, a ## App Store Connect completion -The App Store Connect API covers nearly all remaining work; drive it from a CLI, not a browser. Offer to install a dedicated App Store Connect CLI with one explicit consent question: \`asc\` (rorkai/App-Store-Connect-CLI, \`brew install asc\`) is the default offer; ittybittyapps/appstoreconnect-cli and codemagic-ci-cd cli-tools are equivalents if the user prefers them. It is a machine-level tool authenticated with the same App Store Connect API key, never a project dependency, and its telemetry is disabled unless the user opts in. If the user already has dedicated App Store Connect agent skills installed (for example rorkai/app-store-connect-cli-skills via the standard skills installer), defer to those flows instead of duplicating them. +Drive the remaining storefront work from a CLI, not a browser, on the credential the user actually has. For the baseline session-only user, fastlane \`deliver\` owns this stage end to end: description, keywords, localizations, screenshot upload, attaching the build, and Submit for Review, all on \`FASTLANE_SESSION\`. When the user separately holds an App Store Connect API key, offer \`asc\` (rorkai/App-Store-Connect-CLI, \`brew install asc\`) instead — JSON-first and the better agent surface (ittybittyapps/appstoreconnect-cli and codemagic-ci-cd cli-tools are equivalents); one tool per credential world, never both in one release. Any storefront CLI is a machine-level tool, never a project dependency, with telemetry disabled unless the user opts in. If the user already has dedicated App Store Connect agent skills installed (for example rorkai/app-store-connect-cli-skills via the standard skills installer), defer to those flows instead of duplicating them. Through the CLI: description, keywords, and localizations; screenshot upload per required device size; TestFlight groups and testers as an intermediate distribution before review; attaching the uploaded build to the version; Submit for Review; and review-status monitoring afterward. Submission is an external effect like the upload: run it through the durable state wrapper with a key like \`appstore.submit..\`. The public API cannot create the initial app record — but the CLI can: \`asc web apps create --name --bundle-id --sku \` uses an Apple web session (the same mechanism as fastlane produce) and is the canonical app-creation path. Never call the app record a manual gate. With a cached web session (\`asc web auth status\`) it runs fully headless; a fresh login (\`asc web auth login --apple-id \`) takes the password from a secure prompt or \`ASC_WEB_PASSWORD\` and can resolve two-factor codes programmatically via \`--two-factor-code-command\` (or \`ASC_WEB_2FA_CODE_COMMAND\`) when the user has approved a local code source; otherwise hand off for the single 2FA entry and resume. Bundle ID registration rides the same family (\`asc web bundle-ids\`, with create preflight built in). Never store or echo the Apple ID password; the session cache is the credential. -The autonomy contract: an active paid membership plus Apple ID credentials is sufficient to run the ENTIRE release from the CLI — app record and bundle ID via \`asc web\`, upload/TestFlight/submit via the API key when present or session-authenticated fastlane when not. Never declare a manual gate that a web-session tool covers; when \`asc web\` lacks a step, machine-level fastlane (\`produce\`, \`deliver\`, \`pilot\`) is the completeness fallback before any browser or checklist. A free app needs nothing else, ever. What remains web-only: the membership purchase itself (a precondition, not a release step) and, for PAID apps only, the one-time Paid Apps agreement with banking/tax — offer the agentic-browser drive per \`references/THIRD-PARTY-ACTIONS.md\` before any manual checklist for those. After submission, report that App Review typically answers within a day or two and close the run; review outcome is not a gate this workflow can hold open. +The autonomy contract, written for the baseline user story — an Apple ID and a just-paid membership, nothing else: that is sufficient to run the ENTIRE release from the CLI. One session mint (\`fastlane spaceauth\` or \`asc web auth login\`; the single 2FA entry is automatable via an approved local code source), then app record and bundle ID via \`asc web\` or \`fastlane produce\`, and upload/metadata/TestFlight/submit via session-authenticated \`deliver\`/\`pilot\`. No \`.p8\`, no app-specific password, no browser. Never declare a manual gate that a session-authenticated tool covers. A free app needs nothing else, ever. What remains web-only: the membership purchase itself (a precondition, not a release step) and, for PAID apps only, the one-time Paid Apps agreement with banking/tax — offer the agentic-browser drive per \`references/THIRD-PARTY-ACTIONS.md\` before any manual checklist for those. After submission, report that App Review typically answers within a day or two and close the run; review outcome is not a gate this workflow can hold open. `; } From 4e6a17f9f4a30165bd9ad2694423b05f26638270 Mon Sep 17 00:00:00 2001 From: Sinabina Date: Thu, 23 Jul 2026 17:26:07 -0700 Subject: [PATCH 2/3] chore(gstack2): regenerate Apple release adapter Co-Authored-By: Claude Fable 5 --- skills/ship/references/APPLE-RELEASE.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/skills/ship/references/APPLE-RELEASE.md b/skills/ship/references/APPLE-RELEASE.md index 3de72048ad..e1cc4c19d6 100644 --- a/skills/ship/references/APPLE-RELEASE.md +++ b/skills/ship/references/APPLE-RELEASE.md @@ -25,7 +25,7 @@ Resolve and verify before archiving. Fix what the printed mutation boundary auth 1. Archive the Release configuration: `xcodebuild archive -scheme -destination 'generic/platform=iOS' -archivePath .xcarchive` (substitute the actual platform). 2. Author an export-options plist with method `app-store-connect`. Prefer `destination: upload`, which validates and uploads in one supported step; `destination: export` plus the Transporter app is the fallback. -3. Authenticate with an App Store Connect API key when one exists (`-authenticationKeyPath`, `-authenticationKeyID`, `-authenticationKeyIssuerID`). The `.p8` key is a secret under the `THIRD-PARTY-ACTIONS.md` rules: stored outside the repository, referenced by path, never echoed. No `.p8` is NOT a blocker: Apple ID session auth uploads and submits without one — machine-level fastlane `deliver`/`pilot` with `FASTLANE_SESSION` (minted once by `fastlane spaceauth`) and `FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD` from the environment. Both are env credentials, never argv, never echoed, and fastlane here is a consent-gated machine tool, still never a project dependency. +3. The baseline gstack user has an Apple ID and a just-paid membership — no API key, no app-specific password. That user uploads on session auth: machine-level fastlane `deliver`/`pilot` with `FASTLANE_SESSION`, minted once by `fastlane spaceauth` (one 2FA entry, automatable via an approved local code source; per fastlane's documented auth, the session ALONE suffices for binary upload — `FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD` is an alternative, not a requirement). The session is an env credential: never argv, never echoed, re-minted by the same command when it expires. fastlane is a consent-gated machine tool, still never a project dependency. Only when the user separately holds an App Store Connect API key, prefer `xcodebuild -exportArchive` with `-authenticationKeyPath`/`-authenticationKeyID`/`-authenticationKeyIssuerID`; the `.p8` is a secret under the `THIRD-PARTY-ACTIONS.md` rules: stored outside the repository, referenced by path, never echoed. 4. The upload is an external effect: run it through the durable state wrapper with a key like `appstore.upload..`. Never re-upload on ambiguity; inspect App Store Connect for the build first. ## Store assets @@ -40,10 +40,10 @@ When preflight finds a missing icon, or the storefront step needs screenshots, a ## App Store Connect completion -The App Store Connect API covers nearly all remaining work; drive it from a CLI, not a browser. Offer to install a dedicated App Store Connect CLI with one explicit consent question: `asc` (rorkai/App-Store-Connect-CLI, `brew install asc`) is the default offer; ittybittyapps/appstoreconnect-cli and codemagic-ci-cd cli-tools are equivalents if the user prefers them. It is a machine-level tool authenticated with the same App Store Connect API key, never a project dependency, and its telemetry is disabled unless the user opts in. If the user already has dedicated App Store Connect agent skills installed (for example rorkai/app-store-connect-cli-skills via the standard skills installer), defer to those flows instead of duplicating them. +Drive the remaining storefront work from a CLI, not a browser, on the credential the user actually has. For the baseline session-only user, fastlane `deliver` owns this stage end to end: description, keywords, localizations, screenshot upload, attaching the build, and Submit for Review, all on `FASTLANE_SESSION`. When the user separately holds an App Store Connect API key, offer `asc` (rorkai/App-Store-Connect-CLI, `brew install asc`) instead — JSON-first and the better agent surface (ittybittyapps/appstoreconnect-cli and codemagic-ci-cd cli-tools are equivalents); one tool per credential world, never both in one release. Any storefront CLI is a machine-level tool, never a project dependency, with telemetry disabled unless the user opts in. If the user already has dedicated App Store Connect agent skills installed (for example rorkai/app-store-connect-cli-skills via the standard skills installer), defer to those flows instead of duplicating them. Through the CLI: description, keywords, and localizations; screenshot upload per required device size; TestFlight groups and testers as an intermediate distribution before review; attaching the uploaded build to the version; Submit for Review; and review-status monitoring afterward. Submission is an external effect like the upload: run it through the durable state wrapper with a key like `appstore.submit..`. The public API cannot create the initial app record — but the CLI can: `asc web apps create --name --bundle-id --sku ` uses an Apple web session (the same mechanism as fastlane produce) and is the canonical app-creation path. Never call the app record a manual gate. With a cached web session (`asc web auth status`) it runs fully headless; a fresh login (`asc web auth login --apple-id `) takes the password from a secure prompt or `ASC_WEB_PASSWORD` and can resolve two-factor codes programmatically via `--two-factor-code-command` (or `ASC_WEB_2FA_CODE_COMMAND`) when the user has approved a local code source; otherwise hand off for the single 2FA entry and resume. Bundle ID registration rides the same family (`asc web bundle-ids`, with create preflight built in). Never store or echo the Apple ID password; the session cache is the credential. -The autonomy contract: an active paid membership plus Apple ID credentials is sufficient to run the ENTIRE release from the CLI — app record and bundle ID via `asc web`, upload/TestFlight/submit via the API key when present or session-authenticated fastlane when not. Never declare a manual gate that a web-session tool covers; when `asc web` lacks a step, machine-level fastlane (`produce`, `deliver`, `pilot`) is the completeness fallback before any browser or checklist. A free app needs nothing else, ever. What remains web-only: the membership purchase itself (a precondition, not a release step) and, for PAID apps only, the one-time Paid Apps agreement with banking/tax — offer the agentic-browser drive per `references/THIRD-PARTY-ACTIONS.md` before any manual checklist for those. After submission, report that App Review typically answers within a day or two and close the run; review outcome is not a gate this workflow can hold open. +The autonomy contract, written for the baseline user story — an Apple ID and a just-paid membership, nothing else: that is sufficient to run the ENTIRE release from the CLI. One session mint (`fastlane spaceauth` or `asc web auth login`; the single 2FA entry is automatable via an approved local code source), then app record and bundle ID via `asc web` or `fastlane produce`, and upload/metadata/TestFlight/submit via session-authenticated `deliver`/`pilot`. No `.p8`, no app-specific password, no browser. Never declare a manual gate that a session-authenticated tool covers. A free app needs nothing else, ever. What remains web-only: the membership purchase itself (a precondition, not a release step) and, for PAID apps only, the one-time Paid Apps agreement with banking/tax — offer the agentic-browser drive per `references/THIRD-PARTY-ACTIONS.md` before any manual checklist for those. After submission, report that App Review typically answers within a day or two and close the run; review outcome is not a gate this workflow can hold open. From 905d996fdaceb37b6cfe50aa6de326325d9df8fb Mon Sep 17 00:00:00 2001 From: Sinabina Date: Thu, 23 Jul 2026 17:26:07 -0700 Subject: [PATCH 3/3] docs: CHANGELOG + VERSION 1.64.5.0 Co-Authored-By: Claude Fable 5 --- CHANGELOG.md | 13 +++++++++++++ VERSION | 2 +- package.json | 2 +- 3 files changed, 15 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0b8d09304a..8dc8a0f6c2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,19 @@ > completion state and remaining P0 gates. No version bump or release claim is > made here while that status holds. +## [1.64.5.0] - 2026-07-24 + +**The baseline user has an Apple ID and a $99 receipt.** +**The whole release is now designed around exactly that.** + +Previously the Apple release adapter treated the App Store Connect API key as the main road and session auth as the detour. Backwards: almost nobody starts with a `.p8`. The adapter now assumes you have nothing but an Apple ID and a just-paid membership, and the entire flow runs on one session mint (`fastlane spaceauth`, one 2FA entry, automatable): app record via `asc web` or `produce`, upload and TestFlight and Submit via session-authenticated `deliver`/`pilot`. Per fastlane's documented auth, the session alone covers binary upload — no app-specific password, no key, no browser. Holding a `.p8` becomes the optional upgrade that switches the storefront stage to the JSON-first `asc` CLI: one tool per credential world, never both in one release. + +### Itemized changes + +### Changed + +- `references/APPLE-RELEASE.md` (ship tree): upload step rewritten around the session-only baseline (fastlane `deliver`/`pilot` on `FASTLANE_SESSION`; app-specific password documented as an alternative, not a requirement); storefront completion picks its CLI by credential world (session → `deliver`, API key → `asc`); autonomy contract restated from the baseline user story. + ## [1.64.4.0] - 2026-07-24 **Membership plus Apple ID credentials is the whole requirement.** diff --git a/VERSION b/VERSION index dfe792c06a..aabcb3a080 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.64.4.0 +1.64.5.0 diff --git a/package.json b/package.json index 64b50fc43a..4dc79e4f86 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "gstack", - "version": "1.64.4.0", + "version": "1.64.5.0", "description": "GStack 2 \u2014 six portable Agent Skills with an optional host-neutral runtime.", "license": "MIT", "type": "module",