diff --git a/CHANGELOG.md b/CHANGELOG.md index 8dc8a0f6c2..53192ae9f2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,19 @@ > completion state and remaining P0 gates. No version bump or release claim is > made here while that status holds. +## [1.64.6.0] - 2026-07-24 + +**Authentication is not a question.** +**gstack says "installing fastlane," and gets on with it.** + +A live release run asked the user to pick between three auth paths, with a browser-driven API key as the recommended option. Wrong on every axis: the baseline user has one path, and a question about it is friction with no decision behind it. The adapter now resolves auth silently — a `.p8` already on the machine gets used, and everyone else gets one line ("fastlane is required for the upload, installing it") followed by the session mint. No auth menu, no API-key option shown to someone with no key, and browser drives for credential creation are gone entirely. + +### Itemized changes + +### Changed + +- `references/APPLE-RELEASE.md` (ship tree): auth resolution is silent and deterministic — existing `.p8` → xcodebuild key flags; otherwise announce-and-install fastlane (the /ship authorization covers the machine-tool install) and mint `FASTLANE_SESSION`. Asking the user to choose an auth mechanism, or offering a browser drive to create credentials, is now a contract violation. Storefront CLI selection follows the resolved credential, never a second question. + ## [1.64.5.0] - 2026-07-24 **The baseline user has an Apple ID and a $99 receipt.** diff --git a/VERSION b/VERSION index aabcb3a080..e9aee1e697 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.64.5.0 +1.64.6.0 diff --git a/package.json b/package.json index 4dc79e4f86..4d8cb6b4a4 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "gstack", - "version": "1.64.5.0", + "version": "1.64.6.0", "description": "GStack 2 \u2014 six portable Agent Skills with an optional host-neutral runtime.", "license": "MIT", "type": "module", diff --git a/scripts/gstack2/generate-skill-tree.ts b/scripts/gstack2/generate-skill-tree.ts index 80f6c9c7f8..26f76c1ef6 100644 --- a/scripts/gstack2/generate-skill-tree.ts +++ b/scripts/gstack2/generate-skill-tree.ts @@ -662,7 +662,7 @@ Resolve and verify before archiving. Fix what the printed mutation boundary auth 1. Archive the Release configuration: \`xcodebuild archive -scheme -destination 'generic/platform=iOS' -archivePath .xcarchive\` (substitute the actual platform). 2. Author an export-options plist with method \`app-store-connect\`. Prefer \`destination: upload\`, which validates and uploads in one supported step; \`destination: export\` plus the Transporter app is the fallback. -3. The baseline gstack user has an Apple ID and a just-paid membership — no API key, no app-specific password. That user uploads on session auth: machine-level fastlane \`deliver\`/\`pilot\` with \`FASTLANE_SESSION\`, minted once by \`fastlane spaceauth\` (one 2FA entry, automatable via an approved local code source; per fastlane's documented auth, the session ALONE suffices for binary upload — \`FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD\` is an alternative, not a requirement). The session is an env credential: never argv, never echoed, re-minted by the same command when it expires. fastlane is a consent-gated machine tool, still never a project dependency. Only when the user separately holds an App Store Connect API key, prefer \`xcodebuild -exportArchive\` with \`-authenticationKeyPath\`/\`-authenticationKeyID\`/\`-authenticationKeyIssuerID\`; the \`.p8\` is a secret under the \`THIRD-PARTY-ACTIONS.md\` rules: stored outside the repository, referenced by path, never echoed. +3. Authentication is NOT a question. Never ask the user to choose an auth path, never present an API-key option to someone who has no key, and never offer a browser drive to create credentials. Resolve it silently: if a \`.p8\` App Store Connect API key already exists on this machine (a known path or env configuration), use it via \`xcodebuild -exportArchive\` (\`-authenticationKeyPath\`/\`-authenticationKeyID\`/\`-authenticationKeyIssuerID\`) — the \`.p8\` is a secret under the \`THIRD-PARTY-ACTIONS.md\` rules: stored outside the repository, referenced by path, never echoed. Otherwise — the baseline gstack user, who has an Apple ID and a just-paid membership and nothing else — state in one line that fastlane is required for the upload, install it (\`brew install fastlane\`; the /ship authorization covers this machine-tool install), and mint the session: \`fastlane spaceauth\`. The user's entire contribution is their password and one 2FA code (automatable via an approved local code source). Per fastlane's documented auth, \`FASTLANE_SESSION\` ALONE suffices for binary upload via \`deliver\`/\`pilot\` — \`FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD\` is an alternative, not a requirement. The session is an env credential: never argv, never echoed, re-minted by the same command when it expires. fastlane is a machine tool, still never a project dependency. 4. The upload is an external effect: run it through the durable state wrapper with a key like \`appstore.upload..\`. Never re-upload on ambiguity; inspect App Store Connect for the build first. ## Store assets @@ -677,7 +677,7 @@ When preflight finds a missing icon, or the storefront step needs screenshots, a ## App Store Connect completion -Drive the remaining storefront work from a CLI, not a browser, on the credential the user actually has. For the baseline session-only user, fastlane \`deliver\` owns this stage end to end: description, keywords, localizations, screenshot upload, attaching the build, and Submit for Review, all on \`FASTLANE_SESSION\`. When the user separately holds an App Store Connect API key, offer \`asc\` (rorkai/App-Store-Connect-CLI, \`brew install asc\`) instead — JSON-first and the better agent surface (ittybittyapps/appstoreconnect-cli and codemagic-ci-cd cli-tools are equivalents); one tool per credential world, never both in one release. Any storefront CLI is a machine-level tool, never a project dependency, with telemetry disabled unless the user opts in. If the user already has dedicated App Store Connect agent skills installed (for example rorkai/app-store-connect-cli-skills via the standard skills installer), defer to those flows instead of duplicating them. +Drive the remaining storefront work from a CLI, not a browser, on the credential resolved in the upload step — same rule: not a question. Baseline session-only user: fastlane \`deliver\` owns this stage end to end — description, keywords, localizations, screenshot upload, attaching the build, and Submit for Review, all on \`FASTLANE_SESSION\`. Only a user whose \`.p8\` was found in the upload step routes here through \`asc\` (rorkai/App-Store-Connect-CLI, \`brew install asc\`; ittybittyapps/appstoreconnect-cli and codemagic-ci-cd cli-tools are equivalents) — JSON-first and the better agent surface; one tool per credential world, never both in one release. Any storefront CLI is a machine-level tool, never a project dependency, with telemetry disabled unless the user opts in. If the user already has dedicated App Store Connect agent skills installed (for example rorkai/app-store-connect-cli-skills via the standard skills installer), defer to those flows instead of duplicating them. Through the CLI: description, keywords, and localizations; screenshot upload per required device size; TestFlight groups and testers as an intermediate distribution before review; attaching the uploaded build to the version; Submit for Review; and review-status monitoring afterward. Submission is an external effect like the upload: run it through the durable state wrapper with a key like \`appstore.submit..\`. diff --git a/skills/ship/references/APPLE-RELEASE.md b/skills/ship/references/APPLE-RELEASE.md index e1cc4c19d6..37ed81fa65 100644 --- a/skills/ship/references/APPLE-RELEASE.md +++ b/skills/ship/references/APPLE-RELEASE.md @@ -25,7 +25,7 @@ Resolve and verify before archiving. Fix what the printed mutation boundary auth 1. Archive the Release configuration: `xcodebuild archive -scheme -destination 'generic/platform=iOS' -archivePath .xcarchive` (substitute the actual platform). 2. Author an export-options plist with method `app-store-connect`. Prefer `destination: upload`, which validates and uploads in one supported step; `destination: export` plus the Transporter app is the fallback. -3. The baseline gstack user has an Apple ID and a just-paid membership — no API key, no app-specific password. That user uploads on session auth: machine-level fastlane `deliver`/`pilot` with `FASTLANE_SESSION`, minted once by `fastlane spaceauth` (one 2FA entry, automatable via an approved local code source; per fastlane's documented auth, the session ALONE suffices for binary upload — `FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD` is an alternative, not a requirement). The session is an env credential: never argv, never echoed, re-minted by the same command when it expires. fastlane is a consent-gated machine tool, still never a project dependency. Only when the user separately holds an App Store Connect API key, prefer `xcodebuild -exportArchive` with `-authenticationKeyPath`/`-authenticationKeyID`/`-authenticationKeyIssuerID`; the `.p8` is a secret under the `THIRD-PARTY-ACTIONS.md` rules: stored outside the repository, referenced by path, never echoed. +3. Authentication is NOT a question. Never ask the user to choose an auth path, never present an API-key option to someone who has no key, and never offer a browser drive to create credentials. Resolve it silently: if a `.p8` App Store Connect API key already exists on this machine (a known path or env configuration), use it via `xcodebuild -exportArchive` (`-authenticationKeyPath`/`-authenticationKeyID`/`-authenticationKeyIssuerID`) — the `.p8` is a secret under the `THIRD-PARTY-ACTIONS.md` rules: stored outside the repository, referenced by path, never echoed. Otherwise — the baseline gstack user, who has an Apple ID and a just-paid membership and nothing else — state in one line that fastlane is required for the upload, install it (`brew install fastlane`; the /ship authorization covers this machine-tool install), and mint the session: `fastlane spaceauth`. The user's entire contribution is their password and one 2FA code (automatable via an approved local code source). Per fastlane's documented auth, `FASTLANE_SESSION` ALONE suffices for binary upload via `deliver`/`pilot` — `FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD` is an alternative, not a requirement. The session is an env credential: never argv, never echoed, re-minted by the same command when it expires. fastlane is a machine tool, still never a project dependency. 4. The upload is an external effect: run it through the durable state wrapper with a key like `appstore.upload..`. Never re-upload on ambiguity; inspect App Store Connect for the build first. ## Store assets @@ -40,7 +40,7 @@ When preflight finds a missing icon, or the storefront step needs screenshots, a ## App Store Connect completion -Drive the remaining storefront work from a CLI, not a browser, on the credential the user actually has. For the baseline session-only user, fastlane `deliver` owns this stage end to end: description, keywords, localizations, screenshot upload, attaching the build, and Submit for Review, all on `FASTLANE_SESSION`. When the user separately holds an App Store Connect API key, offer `asc` (rorkai/App-Store-Connect-CLI, `brew install asc`) instead — JSON-first and the better agent surface (ittybittyapps/appstoreconnect-cli and codemagic-ci-cd cli-tools are equivalents); one tool per credential world, never both in one release. Any storefront CLI is a machine-level tool, never a project dependency, with telemetry disabled unless the user opts in. If the user already has dedicated App Store Connect agent skills installed (for example rorkai/app-store-connect-cli-skills via the standard skills installer), defer to those flows instead of duplicating them. +Drive the remaining storefront work from a CLI, not a browser, on the credential resolved in the upload step — same rule: not a question. Baseline session-only user: fastlane `deliver` owns this stage end to end — description, keywords, localizations, screenshot upload, attaching the build, and Submit for Review, all on `FASTLANE_SESSION`. Only a user whose `.p8` was found in the upload step routes here through `asc` (rorkai/App-Store-Connect-CLI, `brew install asc`; ittybittyapps/appstoreconnect-cli and codemagic-ci-cd cli-tools are equivalents) — JSON-first and the better agent surface; one tool per credential world, never both in one release. Any storefront CLI is a machine-level tool, never a project dependency, with telemetry disabled unless the user opts in. If the user already has dedicated App Store Connect agent skills installed (for example rorkai/app-store-connect-cli-skills via the standard skills installer), defer to those flows instead of duplicating them. Through the CLI: description, keywords, and localizations; screenshot upload per required device size; TestFlight groups and testers as an intermediate distribution before review; attaching the uploaded build to the version; Submit for Review; and review-status monitoring afterward. Submission is an external effect like the upload: run it through the durable state wrapper with a key like `appstore.submit..`.