From 2c512c7c0776c7eb447b00a55cd0c98df6034e06 Mon Sep 17 00:00:00 2001 From: Sinabina Date: Thu, 23 Jul 2026 17:04:51 -0700 Subject: [PATCH 1/3] feat(gstack2): drive App Store Connect web residue via agentic browser App record + .p8 key generation are form fields, not judgment: offer the consent-gated browser drive per THIRD-PARTY-ACTIONS before any manual checklist. Sign-in, 2FA, and payment stay user-performed. Co-Authored-By: Claude Fable 5 --- scripts/gstack2/generate-skill-tree.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/gstack2/generate-skill-tree.ts b/scripts/gstack2/generate-skill-tree.ts index a08b4f821d..5b3e2842c2 100644 --- a/scripts/gstack2/generate-skill-tree.ts +++ b/scripts/gstack2/generate-skill-tree.ts @@ -681,7 +681,7 @@ The App Store Connect API covers nearly all remaining work; drive it from a CLI, Through the CLI: description, keywords, and localizations; screenshot upload per required device size; TestFlight groups and testers as an intermediate distribution before review; attaching the uploaded build to the version; Submit for Review; and review-status monitoring afterward. Submission is an external effect like the upload: run it through the durable state wrapper with a key like \`appstore.submit..\`. -The API cannot create the initial app record (name, bundle ID, SKU, primary language), accept agreements, or configure banking and tax; those stay on the App Store Connect website, offered through \`references/THIRD-PARTY-ACTIONS.md\` or as a short manual checklist. The same fallback applies to any individual field the chosen CLI cannot set. After submission, report that App Review typically answers within a day or two and close the run; review outcome is not a gate this workflow can hold open. +The API cannot create the initial app record (name, bundle ID, SKU, primary language), generate the first API key, accept agreements, or configure banking and tax; those live on the App Store Connect website — but they are form fields, not judgment, so never present them as a manual gate without first offering the agentic-browser drive per \`references/THIRD-PARTY-ACTIONS.md\`. With consent, drive the app-record form and the Users and Access → Integrations key generation directly on the user's logged-in session, saving the downloaded \`.p8\` to a user-approved path outside the repository. The only steps that are genuinely the user's are Apple ID sign-in, two-factor confirmation, and payment; hand off for those moments and resume. A manual checklist is the fallback when no agentic browser is available or the user declines. The same applies to any individual field the chosen CLI cannot set. After submission, report that App Review typically answers within a day or two and close the run; review outcome is not a gate this workflow can hold open. `; } From 028bed638d0344516f30a7a5aa381d57421a10ee Mon Sep 17 00:00:00 2001 From: Sinabina Date: Thu, 23 Jul 2026 17:04:52 -0700 Subject: [PATCH 2/3] chore(gstack2): regenerate Apple release adapter Co-Authored-By: Claude Fable 5 --- skills/ship/references/APPLE-RELEASE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/skills/ship/references/APPLE-RELEASE.md b/skills/ship/references/APPLE-RELEASE.md index 4262bbdfa4..4e5f912fda 100644 --- a/skills/ship/references/APPLE-RELEASE.md +++ b/skills/ship/references/APPLE-RELEASE.md @@ -44,4 +44,4 @@ The App Store Connect API covers nearly all remaining work; drive it from a CLI, Through the CLI: description, keywords, and localizations; screenshot upload per required device size; TestFlight groups and testers as an intermediate distribution before review; attaching the uploaded build to the version; Submit for Review; and review-status monitoring afterward. Submission is an external effect like the upload: run it through the durable state wrapper with a key like `appstore.submit..`. -The API cannot create the initial app record (name, bundle ID, SKU, primary language), accept agreements, or configure banking and tax; those stay on the App Store Connect website, offered through `references/THIRD-PARTY-ACTIONS.md` or as a short manual checklist. The same fallback applies to any individual field the chosen CLI cannot set. After submission, report that App Review typically answers within a day or two and close the run; review outcome is not a gate this workflow can hold open. +The API cannot create the initial app record (name, bundle ID, SKU, primary language), generate the first API key, accept agreements, or configure banking and tax; those live on the App Store Connect website — but they are form fields, not judgment, so never present them as a manual gate without first offering the agentic-browser drive per `references/THIRD-PARTY-ACTIONS.md`. With consent, drive the app-record form and the Users and Access → Integrations key generation directly on the user's logged-in session, saving the downloaded `.p8` to a user-approved path outside the repository. The only steps that are genuinely the user's are Apple ID sign-in, two-factor confirmation, and payment; hand off for those moments and resume. A manual checklist is the fallback when no agentic browser is available or the user declines. The same applies to any individual field the chosen CLI cannot set. After submission, report that App Review typically answers within a day or two and close the run; review outcome is not a gate this workflow can hold open. From 6984ff80b65c6bca72cb4200911d3f8e87a931ae Mon Sep 17 00:00:00 2001 From: Sinabina Date: Thu, 23 Jul 2026 17:04:52 -0700 Subject: [PATCH 3/3] docs: CHANGELOG + VERSION 1.64.1.0 Co-Authored-By: Claude Fable 5 --- CHANGELOG.md | 13 +++++++++++++ VERSION | 2 +- package.json | 2 +- 3 files changed, 15 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index dc47f01ce5..9c291ca0e6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,19 @@ > completion state and remaining P0 gates. No version bump or release claim is > made here while that status holds. +## [1.64.1.0] - 2026-07-23 + +**The App Store "manual gate" mostly isn't.** +**gstack now offers to drive it, not describe it.** + +Apple's API refuses four things: creating the app record, generating the first API key, agreements, and banking/tax. Those are form fields on a website, not judgment, so the Apple release adapter no longer hands you a checklist for them. With your consent it drives the app-record form and the API-key generation on your logged-in App Store Connect session, saves the .p8 to a path you approve, and hands off only for the moments that are genuinely yours: Apple ID sign-in, two-factor, payment. The checklist survives as the fallback when no agentic browser is available or you decline. + +### Itemized changes + +### Changed + +- `references/APPLE-RELEASE.md` (ship tree): App Store Connect web residue routes through the agentic-browser drive in `THIRD-PARTY-ACTIONS.md` first — app record, .p8 key generation with download-to-approved-path — with sign-in/2FA/payment as explicit user-performed hand-offs. Manual checklist demoted to fallback. + ## [1.64.0.0] - 2026-07-23 ## **/ship now takes an Apple app from working tree** diff --git a/VERSION b/VERSION index 6a0ed664dd..362038af84 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.64.0.0 +1.64.1.0 diff --git a/package.json b/package.json index 3d149b42d4..79e4727175 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "gstack", - "version": "1.64.0.0", + "version": "1.64.1.0", "description": "GStack 2 \u2014 six portable Agent Skills with an optional host-neutral runtime.", "license": "MIT", "type": "module",