Authentication is not a question (v1.64.6.0)

CHANGELOG.md

@@ -7,6 +7,19 @@
 > completion state and remaining P0 gates. No version bump or release claim is
 > made here while that status holds.
 
+## [1.64.6.0] - 2026-07-24
+
+**Authentication is not a question.**
+**gstack says "installing fastlane," and gets on with it.**
+
+A live release run asked the user to pick between three auth paths, with a browser-driven API key as the recommended option. Wrong on every axis: the baseline user has one path, and a question about it is friction with no decision behind it. The adapter now resolves auth silently — a `.p8` already on the machine gets used, and everyone else gets one line ("fastlane is required for the upload, installing it") followed by the session mint. No auth menu, no API-key option shown to someone with no key, and browser drives for credential creation are gone entirely.
+
+### Itemized changes
+
+### Changed
+
+- `references/APPLE-RELEASE.md` (ship tree): auth resolution is silent and deterministic — existing `.p8` → xcodebuild key flags; otherwise announce-and-install fastlane (the /ship authorization covers the machine-tool install) and mint `FASTLANE_SESSION`. Asking the user to choose an auth mechanism, or offering a browser drive to create credentials, is now a contract violation. Storefront CLI selection follows the resolved credential, never a second question.
+
 ## [1.64.5.0] - 2026-07-24
 
 **The baseline user has an Apple ID and a $99 receipt.**

VERSION

@@ -1 +1 @@
-1.64.5.0
+1.64.6.0

package.json

@@ -1,6 +1,6 @@
 {
   "name": "gstack",
-  "version": "1.64.5.0",
+  "version": "1.64.6.0",
   "description": "GStack 2 \u2014 six portable Agent Skills with an optional host-neutral runtime.",
   "license": "MIT",
   "type": "module",

scripts/gstack2/generate-skill-tree.ts

@@ -662,7 +662,7 @@ Resolve and verify before archiving. Fix what the printed mutation boundary auth
 
 1. Archive the Release configuration: \`xcodebuild archive -scheme <scheme> -destination 'generic/platform=iOS' -archivePath <name>.xcarchive\` (substitute the actual platform).
 2. Author an export-options plist with method \`app-store-connect\`. Prefer \`destination: upload\`, which validates and uploads in one supported step; \`destination: export\` plus the Transporter app is the fallback.
-3. The baseline gstack user has an Apple ID and a just-paid membership — no API key, no app-specific password. That user uploads on session auth: machine-level fastlane \`deliver\`/\`pilot\` with \`FASTLANE_SESSION\`, minted once by \`fastlane spaceauth\` (one 2FA entry, automatable via an approved local code source; per fastlane's documented auth, the session ALONE suffices for binary upload — \`FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD\` is an alternative, not a requirement). The session is an env credential: never argv, never echoed, re-minted by the same command when it expires. fastlane is a consent-gated machine tool, still never a project dependency. Only when the user separately holds an App Store Connect API key, prefer \`xcodebuild -exportArchive\` with \`-authenticationKeyPath\`/\`-authenticationKeyID\`/\`-authenticationKeyIssuerID\`; the \`.p8\` is a secret under the \`THIRD-PARTY-ACTIONS.md\` rules: stored outside the repository, referenced by path, never echoed.
+3. Authentication is NOT a question. Never ask the user to choose an auth path, never present an API-key option to someone who has no key, and never offer a browser drive to create credentials. Resolve it silently: if a \`.p8\` App Store Connect API key already exists on this machine (a known path or env configuration), use it via \`xcodebuild -exportArchive\` (\`-authenticationKeyPath\`/\`-authenticationKeyID\`/\`-authenticationKeyIssuerID\`) — the \`.p8\` is a secret under the \`THIRD-PARTY-ACTIONS.md\` rules: stored outside the repository, referenced by path, never echoed. Otherwise — the baseline gstack user, who has an Apple ID and a just-paid membership and nothing else — state in one line that fastlane is required for the upload, install it (\`brew install fastlane\`; the /ship authorization covers this machine-tool install), and mint the session: \`fastlane spaceauth\`. The user's entire contribution is their password and one 2FA code (automatable via an approved local code source). Per fastlane's documented auth, \`FASTLANE_SESSION\` ALONE suffices for binary upload via \`deliver\`/\`pilot\` — \`FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD\` is an alternative, not a requirement. The session is an env credential: never argv, never echoed, re-minted by the same command when it expires. fastlane is a machine tool, still never a project dependency.
 4. The upload is an external effect: run it through the durable state wrapper with a key like \`appstore.upload.<bundle-id>.<build>\`. Never re-upload on ambiguity; inspect App Store Connect for the build first.
 
 ## Store assets
@@ -677,7 +677,7 @@ When preflight finds a missing icon, or the storefront step needs screenshots, a
 
 ## App Store Connect completion
 
-Drive the remaining storefront work from a CLI, not a browser, on the credential the user actually has. For the baseline session-only user, fastlane \`deliver\` owns this stage end to end: description, keywords, localizations, screenshot upload, attaching the build, and Submit for Review, all on \`FASTLANE_SESSION\`. When the user separately holds an App Store Connect API key, offer \`asc\` (rorkai/App-Store-Connect-CLI, \`brew install asc\`) instead — JSON-first and the better agent surface (ittybittyapps/appstoreconnect-cli and codemagic-ci-cd cli-tools are equivalents); one tool per credential world, never both in one release. Any storefront CLI is a machine-level tool, never a project dependency, with telemetry disabled unless the user opts in. If the user already has dedicated App Store Connect agent skills installed (for example rorkai/app-store-connect-cli-skills via the standard skills installer), defer to those flows instead of duplicating them.
+Drive the remaining storefront work from a CLI, not a browser, on the credential resolved in the upload step — same rule: not a question. Baseline session-only user: fastlane \`deliver\` owns this stage end to end — description, keywords, localizations, screenshot upload, attaching the build, and Submit for Review, all on \`FASTLANE_SESSION\`. Only a user whose \`.p8\` was found in the upload step routes here through \`asc\` (rorkai/App-Store-Connect-CLI, \`brew install asc\`; ittybittyapps/appstoreconnect-cli and codemagic-ci-cd cli-tools are equivalents) — JSON-first and the better agent surface; one tool per credential world, never both in one release. Any storefront CLI is a machine-level tool, never a project dependency, with telemetry disabled unless the user opts in. If the user already has dedicated App Store Connect agent skills installed (for example rorkai/app-store-connect-cli-skills via the standard skills installer), defer to those flows instead of duplicating them.
 
 Through the CLI: description, keywords, and localizations; screenshot upload per required device size; TestFlight groups and testers as an intermediate distribution before review; attaching the uploaded build to the version; Submit for Review; and review-status monitoring afterward. Submission is an external effect like the upload: run it through the durable state wrapper with a key like \`appstore.submit.<bundle-id>.<version>\`.