Apple release designed around the session-only baseline user (v1.64.5.0)

CHANGELOG.md

@@ -7,6 +7,19 @@
 > completion state and remaining P0 gates. No version bump or release claim is
 > made here while that status holds.
 
+## [1.64.5.0] - 2026-07-24
+
+**The baseline user has an Apple ID and a $99 receipt.**
+**The whole release is now designed around exactly that.**
+
+Previously the Apple release adapter treated the App Store Connect API key as the main road and session auth as the detour. Backwards: almost nobody starts with a `.p8`. The adapter now assumes you have nothing but an Apple ID and a just-paid membership, and the entire flow runs on one session mint (`fastlane spaceauth`, one 2FA entry, automatable): app record via `asc web` or `produce`, upload and TestFlight and Submit via session-authenticated `deliver`/`pilot`. Per fastlane's documented auth, the session alone covers binary upload — no app-specific password, no key, no browser. Holding a `.p8` becomes the optional upgrade that switches the storefront stage to the JSON-first `asc` CLI: one tool per credential world, never both in one release.
+
+### Itemized changes
+
+### Changed
+
+- `references/APPLE-RELEASE.md` (ship tree): upload step rewritten around the session-only baseline (fastlane `deliver`/`pilot` on `FASTLANE_SESSION`; app-specific password documented as an alternative, not a requirement); storefront completion picks its CLI by credential world (session → `deliver`, API key → `asc`); autonomy contract restated from the baseline user story.
+
 ## [1.64.4.0] - 2026-07-24
 
 **Membership plus Apple ID credentials is the whole requirement.**

VERSION

@@ -1 +1 @@
-1.64.4.0
+1.64.5.0

package.json

@@ -1,6 +1,6 @@
 {
   "name": "gstack",
-  "version": "1.64.4.0",
+  "version": "1.64.5.0",
   "description": "GStack 2 \u2014 six portable Agent Skills with an optional host-neutral runtime.",
   "license": "MIT",
   "type": "module",

scripts/gstack2/generate-skill-tree.ts

@@ -662,7 +662,7 @@ Resolve and verify before archiving. Fix what the printed mutation boundary auth
 
 1. Archive the Release configuration: \`xcodebuild archive -scheme <scheme> -destination 'generic/platform=iOS' -archivePath <name>.xcarchive\` (substitute the actual platform).
 2. Author an export-options plist with method \`app-store-connect\`. Prefer \`destination: upload\`, which validates and uploads in one supported step; \`destination: export\` plus the Transporter app is the fallback.
-3. Authenticate with an App Store Connect API key when one exists (\`-authenticationKeyPath\`, \`-authenticationKeyID\`, \`-authenticationKeyIssuerID\`). The \`.p8\` key is a secret under the \`THIRD-PARTY-ACTIONS.md\` rules: stored outside the repository, referenced by path, never echoed. No \`.p8\` is NOT a blocker: Apple ID session auth uploads and submits without one — machine-level fastlane \`deliver\`/\`pilot\` with \`FASTLANE_SESSION\` (minted once by \`fastlane spaceauth\`) and \`FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD\` from the environment. Both are env credentials, never argv, never echoed, and fastlane here is a consent-gated machine tool, still never a project dependency.
+3. The baseline gstack user has an Apple ID and a just-paid membership — no API key, no app-specific password. That user uploads on session auth: machine-level fastlane \`deliver\`/\`pilot\` with \`FASTLANE_SESSION\`, minted once by \`fastlane spaceauth\` (one 2FA entry, automatable via an approved local code source; per fastlane's documented auth, the session ALONE suffices for binary upload — \`FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD\` is an alternative, not a requirement). The session is an env credential: never argv, never echoed, re-minted by the same command when it expires. fastlane is a consent-gated machine tool, still never a project dependency. Only when the user separately holds an App Store Connect API key, prefer \`xcodebuild -exportArchive\` with \`-authenticationKeyPath\`/\`-authenticationKeyID\`/\`-authenticationKeyIssuerID\`; the \`.p8\` is a secret under the \`THIRD-PARTY-ACTIONS.md\` rules: stored outside the repository, referenced by path, never echoed.
 4. The upload is an external effect: run it through the durable state wrapper with a key like \`appstore.upload.<bundle-id>.<build>\`. Never re-upload on ambiguity; inspect App Store Connect for the build first.
 
 ## Store assets
@@ -677,13 +677,13 @@ When preflight finds a missing icon, or the storefront step needs screenshots, a
 
 ## App Store Connect completion
 
-The App Store Connect API covers nearly all remaining work; drive it from a CLI, not a browser. Offer to install a dedicated App Store Connect CLI with one explicit consent question: \`asc\` (rorkai/App-Store-Connect-CLI, \`brew install asc\`) is the default offer; ittybittyapps/appstoreconnect-cli and codemagic-ci-cd cli-tools are equivalents if the user prefers them. It is a machine-level tool authenticated with the same App Store Connect API key, never a project dependency, and its telemetry is disabled unless the user opts in. If the user already has dedicated App Store Connect agent skills installed (for example rorkai/app-store-connect-cli-skills via the standard skills installer), defer to those flows instead of duplicating them.
+Drive the remaining storefront work from a CLI, not a browser, on the credential the user actually has. For the baseline session-only user, fastlane \`deliver\` owns this stage end to end: description, keywords, localizations, screenshot upload, attaching the build, and Submit for Review, all on \`FASTLANE_SESSION\`. When the user separately holds an App Store Connect API key, offer \`asc\` (rorkai/App-Store-Connect-CLI, \`brew install asc\`) instead — JSON-first and the better agent surface (ittybittyapps/appstoreconnect-cli and codemagic-ci-cd cli-tools are equivalents); one tool per credential world, never both in one release. Any storefront CLI is a machine-level tool, never a project dependency, with telemetry disabled unless the user opts in. If the user already has dedicated App Store Connect agent skills installed (for example rorkai/app-store-connect-cli-skills via the standard skills installer), defer to those flows instead of duplicating them.
 
 Through the CLI: description, keywords, and localizations; screenshot upload per required device size; TestFlight groups and testers as an intermediate distribution before review; attaching the uploaded build to the version; Submit for Review; and review-status monitoring afterward. Submission is an external effect like the upload: run it through the durable state wrapper with a key like \`appstore.submit.<bundle-id>.<version>\`.
 
 The public API cannot create the initial app record — but the CLI can: \`asc web apps create --name <name> --bundle-id <id> --sku <sku>\` uses an Apple web session (the same mechanism as fastlane produce) and is the canonical app-creation path. Never call the app record a manual gate. With a cached web session (\`asc web auth status\`) it runs fully headless; a fresh login (\`asc web auth login --apple-id <id>\`) takes the password from a secure prompt or \`ASC_WEB_PASSWORD\` and can resolve two-factor codes programmatically via \`--two-factor-code-command\` (or \`ASC_WEB_2FA_CODE_COMMAND\`) when the user has approved a local code source; otherwise hand off for the single 2FA entry and resume. Bundle ID registration rides the same family (\`asc web bundle-ids\`, with create preflight built in). Never store or echo the Apple ID password; the session cache is the credential.
 
-The autonomy contract: an active paid membership plus Apple ID credentials is sufficient to run the ENTIRE release from the CLI — app record and bundle ID via \`asc web\`, upload/TestFlight/submit via the API key when present or session-authenticated fastlane when not. Never declare a manual gate that a web-session tool covers; when \`asc web\` lacks a step, machine-level fastlane (\`produce\`, \`deliver\`, \`pilot\`) is the completeness fallback before any browser or checklist. A free app needs nothing else, ever. What remains web-only: the membership purchase itself (a precondition, not a release step) and, for PAID apps only, the one-time Paid Apps agreement with banking/tax — offer the agentic-browser drive per \`references/THIRD-PARTY-ACTIONS.md\` before any manual checklist for those. After submission, report that App Review typically answers within a day or two and close the run; review outcome is not a gate this workflow can hold open.
+The autonomy contract, written for the baseline user story — an Apple ID and a just-paid membership, nothing else: that is sufficient to run the ENTIRE release from the CLI. One session mint (\`fastlane spaceauth\` or \`asc web auth login\`; the single 2FA entry is automatable via an approved local code source), then app record and bundle ID via \`asc web\` or \`fastlane produce\`, and upload/metadata/TestFlight/submit via session-authenticated \`deliver\`/\`pilot\`. No \`.p8\`, no app-specific password, no browser. Never declare a manual gate that a session-authenticated tool covers. A free app needs nothing else, ever. What remains web-only: the membership purchase itself (a precondition, not a release step) and, for PAID apps only, the one-time Paid Apps agreement with banking/tax — offer the agentic-browser drive per \`references/THIRD-PARTY-ACTIONS.md\` before any manual checklist for those. After submission, report that App Review typically answers within a day or two and close the run; review outcome is not a gate this workflow can hold open.
 `;
 }