@mmerterden/multi-agent-pipeline 14.2.2 → 15.0.0

package/pipeline/schemas/prefs.schema.json

@@ -10,12 +10,24 @@
       "description": "Documentation-only blocks shipped in preferences-template.json (_figmaConfigTemplate, _derivedSkillSourcesTemplate, _devToolkitTemplate). Copy-paste examples, never read by the pipeline."
     }
   },
-  "required": ["schemaVersion", "global", "projects"],
+  "required": [
+    "schemaVersion",
+    "global",
+    "projects"
+  ],
   "properties": {
     "schemaVersion": {
       "type": "string",
-      "enum": ["2.0.0", "2.1.0", "2.2.0", "2.3.0", "2.4.0", "2.5.0"],
-      "description": "v2.0.0: pre-v3.7. v2.1.0: v3.7+ adds identities[].servicePatMap, platformIdentityRouting, recentGroups, recentBranches, serviceStatus, settings, expanded keychainMapping. v2.2.0: v6.0.0 formalizes v5.7 / v5.8 additions (reportChannels, reportContent with technicalAnalysis, wikiScope, autopilotReportTimeoutSeconds) that had been running as 2.1.0 sub-migrations without a proper version bump. v2.5.0: v14.0.0 adds global.skillConformance (Phase 4 criteria resolution) and declares global.ship.autoFix, which the tail command's spec had referenced as global.finish.autoFix without ever declaring it."
+      "enum": [
+        "2.0.0",
+        "2.1.0",
+        "2.2.0",
+        "2.3.0",
+        "2.4.0",
+        "2.5.0",
+        "2.6.0"
+      ],
+      "description": "v2.0.0: pre-v3.7. v2.1.0: v3.7+ adds identities[].servicePatMap, platformIdentityRouting, recentGroups, recentBranches, serviceStatus, settings, expanded keychainMapping. v2.2.0: v6.0.0 formalizes v5.7 / v5.8 additions (reportChannels, reportContent with technicalAnalysis, wikiScope, autopilotReportTimeoutSeconds) that had been running as 2.1.0 sub-migrations without a proper version bump. v2.5.0: v14.0.0 adds global.skillConformance (Phase 4 criteria resolution) and declares global.ship.autoFix, which the tail command's spec had referenced as global.finish.autoFix without ever declaring it. v2.6.0: v15.0.0 renames global.ship to global.resumeLocal (/multi-agent:ship -> :resume-local)."
     },
     "global": {
       "type": "object",
@@ -27,7 +39,10 @@
           "items": {
             "type": "object",
             "additionalProperties": false,
-            "required": ["name", "email"],
+            "required": [
+              "name",
+              "email"
+            ],
             "properties": {
               "name": {
                 "type": "string"
@@ -111,91 +126,160 @@
           "description": "Maps logical token names to actual Keychain item names. Pipeline looks up tokens via `security find-generic-password -s <mapped-name>` (or `pipeline/lib/credential-store.sh get` cross-platform). Covered keys: jira, bitbucket, bitbucket_token, bitbucket_user, github, confluence, figma, figma_mcp, fortify, graylog, firebase, jenkins, npm, claude_oauth_token, claude_oauth_token_fallback. Deprecated and accepted only for backward compatibility: figma_pat (superseded by figma), figma_user (unused).",
           "properties": {
             "jira": {
-              "type": ["string", "null"]
+              "type": [
+                "string",
+                "null"
+              ]
             },
             "bitbucket": {
-              "type": ["string", "null"],
+              "type": [
+                "string",
+                "null"
+              ],
               "description": "Legacy alias for bitbucket_token."
             },
             "bitbucket_token": {
-              "type": ["string", "null"]
+              "type": [
+                "string",
+                "null"
+              ]
             },
             "bitbucket_user": {
-              "type": ["string", "null"]
+              "type": [
+                "string",
+                "null"
+              ]
             },
             "github": {
-              "type": ["string", "null"]
+              "type": [
+                "string",
+                "null"
+              ]
             },
             "confluence": {
-              "type": ["string", "null"]
+              "type": [
+                "string",
+                "null"
+              ]
             },
             "figma": {
-              "type": ["string", "null"],
+              "type": [
+                "string",
+                "null"
+              ],
               "description": "Figma Personal Access Token. The canonical Tier 2 (REST API) key of the Figma access chain - this is the key `figma-token.sh` resolves. Supersedes `figma_pat`."
             },
             "figma_mcp": {
-              "type": ["string", "null"],
+              "type": [
+                "string",
+                "null"
+              ],
               "description": "Figma MCP token. Tier 1 of the Figma access chain. The `mcp__claude_ai_Figma__*` calls themselves authenticate through Anthropic-managed MCP auth, but the token must be onboarded so that flow has something to bind to, and so `lib/figma-mcp-refresh.sh` can renew it."
             },
             "fortify": {
-              "type": ["string", "null"]
+              "type": [
+                "string",
+                "null"
+              ]
             },
             "graylog": {
-              "type": ["string", "null"]
+              "type": [
+                "string",
+                "null"
+              ]
             },
             "figma_pat": {
-              "type": ["string", "null"],
+              "type": [
+                "string",
+                "null"
+              ],
               "deprecated": true,
               "description": "DEPRECATED, pre-v13.6 name for `figma`. Kept so an un-migrated preferences file still validates; `migrate-prefs.mjs` copies the value into `figma` and deletes this key. Never write a new mapping here - the next migration removes it. Runtime lookups read `figma` first and fall back to this key only for installs that have not migrated yet."
             },
             "figma_user": {
-              "type": ["string", "null"],
+              "type": [
+                "string",
+                "null"
+              ],
               "deprecated": true,
               "description": "DEPRECATED and unused. `migrate-prefs.mjs` removes this key; the REST flow authenticates with the PAT alone."
             },
             "claude_oauth_token": {
-              "type": ["string", "null"],
+              "type": [
+                "string",
+                "null"
+              ],
               "description": "Claude Code OAuth token used by headless / scheduled runs."
             },
             "claude_oauth_token_fallback": {
-              "type": ["string", "null"],
+              "type": [
+                "string",
+                "null"
+              ],
               "description": "Secondary OAuth token used when the primary is rate-limited or expired."
             },
             "firebase": {
-              "type": ["string", "null"],
+              "type": [
+                "string",
+                "null"
+              ],
               "description": "Firebase JSON (base64-encoded). project_id is parsed from the decoded JSON."
             },
             "firebase_sa": {
-              "type": ["string", "null"],
+              "type": [
+                "string",
+                "null"
+              ],
               "deprecated": true,
               "description": "DEPRECATED, early-v2.1.0 name for `firebase`. Declared only so a pre-consolidation preferences file still validates long enough for `migrate-prefs.mjs` to copy the value into `firebase` and delete this key. Never write a new mapping here."
             },
             "firebase_project": {
-              "type": ["string", "null"],
+              "type": [
+                "string",
+                "null"
+              ],
               "deprecated": true,
               "description": "DEPRECATED and unused. Declared only so a pre-consolidation preferences file still validates; `migrate-prefs.mjs` removes it, because project_id is parsed from the decoded service-account JSON and needs no separate entry."
             },
             "jenkins": {
-              "type": ["string", "null"]
+              "type": [
+                "string",
+                "null"
+              ]
             },
             "npm": {
-              "type": ["string", "null"],
+              "type": [
+                "string",
+                "null"
+              ],
               "description": "NPM registry token (npm.pkg.github.com or npmjs.com). Used by package publish flow."
             },
             "appstore_connect_key_id": {
-              "type": ["string", "null"],
+              "type": [
+                "string",
+                "null"
+              ],
               "description": "App Store Connect API key ID. Tier 1 of the App Store Connect access chain, used by /multi-agent:store-ready Gate 2 (and its iOS alias /multi-agent:testflight-validation). An identifier rather than a secret; mapped anyway so every credential is read through the same layer. Creating an API key needs an Admin or App Manager role, which is why Tier 2 exists."
             },
             "appstore_connect_issuer_id": {
-              "type": ["string", "null"],
+              "type": [
+                "string",
+                "null"
+              ],
               "description": "App Store Connect API issuer ID. Required alongside appstore_connect_key_id; either alone leaves Tier 1 unusable and the resolver says so instead of silently dropping to Tier 2. The .p8 private key is a FILE and is never stored here - it belongs at ~/.appstoreconnect/private_keys/AuthKey_<keyId>.p8, one of the directories altool searches."
             },
             "appstore_connect_apple_id": {
-              "type": ["string", "null"],
+              "type": [
+                "string",
+                "null"
+              ],
               "description": "Apple ID for Tier 2 of the App Store Connect access chain. Usable by any Apple ID holder with no elevated role, which is the realistic path when API-key creation is not permitted on the account."
             },
             "appstore_connect_password_item": {
-              "type": ["string", "null"],
+              "type": [
+                "string",
+                "null"
+              ],
               "description": "Name of the keychain item holding the app-specific password, created by `altool --store-password-in-keychain-item`. Holds an ITEM NAME, not a password: altool reads the secret itself via `-p @keychain:<item>`, so the value never reaches an argument list or the pipeline."
             }
           }
@@ -203,7 +287,10 @@
         "tokenScripts": {
           "type": "object",
           "additionalProperties": {
-            "type": ["string", "null"]
+            "type": [
+              "string",
+              "null"
+            ]
           },
           "default": {},
           "description": "Maps service ids to user-owned token generation scripts (absolute paths, personal - never synced). Used by the Phase 0 token pre-flight: figma_mcp silent renewal reads the .figma-oauth.json next to tokenScripts.figma_mcp; the 'Regenerate now (script)' option runs the script itself."
@@ -233,7 +320,9 @@
               {
                 "type": "object",
                 "additionalProperties": false,
-                "required": ["path"],
+                "required": [
+                  "path"
+                ],
                 "properties": {
                   "path": {
                     "type": "string"
@@ -263,7 +352,9 @@
             "items": {
               "type": "object",
               "additionalProperties": false,
-              "required": ["branch"],
+              "required": [
+                "branch"
+              ],
               "properties": {
                 "branch": {
                   "type": "string"
@@ -288,7 +379,10 @@
           "items": {
             "type": "object",
             "additionalProperties": false,
-            "required": ["name", "description"],
+            "required": [
+              "name",
+              "description"
+            ],
             "properties": {
               "name": {
                 "type": "string",
@@ -309,7 +403,10 @@
                 "description": "Where the routine came from, e.g. a CLAUDE.md section name or 'user'."
               },
               "trigger": {
-                "type": ["string", "null"],
+                "type": [
+                  "string",
+                  "null"
+                ],
                 "description": "Optional natural-language trigger phrase the routine captures."
               }
             }
@@ -321,7 +418,9 @@
           "items": {
             "type": "object",
             "additionalProperties": false,
-            "required": ["repos"],
+            "required": [
+              "repos"
+            ],
             "properties": {
               "label": {
                 "type": "string",
@@ -353,7 +452,9 @@
           "items": {
             "type": "object",
             "additionalProperties": false,
-            "required": ["repoSet"],
+            "required": [
+              "repoSet"
+            ],
             "properties": {
               "repoSet": {
                 "type": "array",
@@ -373,7 +474,11 @@
               },
               "platform": {
                 "type": "string",
-                "enum": ["ios", "android", "mixed"]
+                "enum": [
+                  "ios",
+                  "android",
+                  "mixed"
+                ]
               },
               "hostScheme": {
                 "type": "string",
@@ -405,7 +510,11 @@
               },
               "lastResult": {
                 "type": "string",
-                "enum": ["success", "failed", "skipped"]
+                "enum": [
+                  "success",
+                  "failed",
+                  "skipped"
+                ]
               }
             }
           },
@@ -417,7 +526,10 @@
           "additionalProperties": {
             "type": "object",
             "additionalProperties": false,
-            "required": ["ok", "checkedAt"],
+            "required": [
+              "ok",
+              "checkedAt"
+            ],
             "properties": {
               "ok": {
                 "type": "boolean"
@@ -496,7 +608,10 @@
           }
         },
         "defaultJiraKey": {
-          "type": ["string", "null"],
+          "type": [
+            "string",
+            "null"
+          ],
           "description": "Default Jira project key used for placeholder replacement. null until /multi-agent:setup onboards a Jira project."
         },
         "modelFallback": {
@@ -510,7 +625,10 @@
               "description": "Master switch for tier fallback."
             },
             "premiumTierUntil": {
-              "type": ["string", "null"],
+              "type": [
+                "string",
+                "null"
+              ],
               "description": "ISO date after which the premium tier is assumed gone. null = no expiry known."
             },
             "fallbackModel": {
@@ -650,14 +768,28 @@
           "type": "array",
           "items": {
             "type": "string",
-            "enum": ["main", "ios", "screenshots", "index"]
+            "enum": [
+              "main",
+              "ios",
+              "screenshots",
+              "index"
+            ]
           },
-          "default": ["main", "ios", "screenshots", "index"],
+          "default": [
+            "main",
+            "ios",
+            "screenshots",
+            "index"
+          ],
           "description": "v5.7+ - Wiki Case A scope multi-select default'u. Component wiki dispatch'inde hangi artifact'lar yaz\u0131lacak: main (ana component sayfas\u0131), ios (iOS sub-page), screenshots (assets/ klas\u00f6r\u00fc), index (_Sidebar.md + ComponentImplementationStatus.md). Legacy wikiDefault=true \u2192 [main,ios,screenshots,index] migration; wikiDefault=false \u2192 [] (empty array = Wiki adapter Case B men\u00fcs\u00fcne d\u00fc\u015fer)."
         },
         "autoJiraFromGithubIssue": {
           "type": "string",
-          "enum": ["ask", "always", "never"],
+          "enum": [
+            "ask",
+            "always",
+            "never"
+          ],
           "default": "ask",
           "description": "Policy for the GitHub-issue Jira auto-create (WS-6 triad, Phase 0 Step 1). `ask` prompts the user when a GitHub issue has no Jira ID. `always` auto-creates silently (and patches the GitHub issue body with the link). `never` skips and uses the `feature/GH{issueNo}-kebab` branch. Autopilot treats `ask` as `always` - there is no interactive fallback when running unattended."
         },
@@ -668,19 +800,29 @@
         },
         "promptLanguage": {
           "type": "string",
-          "enum": ["en", "tr"],
+          "enum": [
+            "en",
+            "tr"
+          ],
           "default": "en",
           "description": "Locked to 'en': the language of LLM-facing instructions (spec files, agent system prompts, reviewer/triage prompts) and picker structural chrome (AskUserQuestion label/header). What humans read is governed by outputLanguage instead - picker question/description, conversational lines, and external payload bodies (PR description, Jira comment, Confluence/Wiki). Always English regardless of either pref: commit messages, branch names, PR titles, code identifiers, agent-log.md. Canonical matrix: multi-agent-refs/rules.md 'Language Application'. Set via /multi-agent:language or /multi-agent:setup."
         },
         "outputLanguage": {
           "type": "string",
-          "enum": ["en", "tr"],
+          "enum": [
+            "en",
+            "tr"
+          ],
           "default": "en",
           "description": "Language used for the assistant's NON-INTERACTIVE explanations, status updates, error messages, and pipeline-generated reports rendered to the user (e.g. `/multi-agent:help` body, `/multi-agent:status` table headers, summary blocks at the end of a run). Independent of `promptLanguage` so a user can have Turkish pickers but English summaries (or vice versa). External payloads (commits, PR/Jira/wiki) and skill-picker / confirmation / error UI exposed by the CLI host stay English regardless of this setting. Set via `/multi-agent:language output <en|tr>` or answered on first run by `/multi-agent:setup`."
         },
         "progressVerbosity": {
           "type": "string",
-          "enum": ["quiet", "normal", "verbose"],
+          "enum": [
+            "quiet",
+            "normal",
+            "verbose"
+          ],
           "default": "normal",
           "description": "Verbosity of the live progress-line contract (`refs/progress-contract.md`). `quiet` shows only phase banners and user prompts (CI-friendly). `normal` shows banners + the canonical action set per phase - recommended for interactive use. `verbose` shows sub-agent internal actions, file-level reads, schema validations, retry internals - forced automatically when `mode: autopilot` is set in agent state so the run remains audit-grade when the user isn't watching live."
         },
@@ -703,7 +845,9 @@
             },
             "model": {
               "type": "string",
-              "enum": ["sonnet"],
+              "enum": [
+                "sonnet"
+              ],
               "default": "sonnet",
               "description": "Cross-check model. Locked to Sonnet - Opus would just agree with Opus."
             },
@@ -762,7 +906,10 @@
             },
             "model": {
               "type": "string",
-              "enum": ["sonnet", "opus"],
+              "enum": [
+                "sonnet",
+                "opus"
+              ],
               "default": "sonnet",
               "description": "Verifier agent model. Writing a minimal repro test is mechanical work; Sonnet is the cost-sane default."
             },
@@ -799,7 +946,11 @@
             },
             "mode": {
               "type": "string",
-              "enum": ["per-tool-call", "per-todo-step", "off"],
+              "enum": [
+                "per-tool-call",
+                "per-todo-step",
+                "off"
+              ],
               "default": "per-todo-step",
               "description": "Snapshot frequency. per-tool-call snapshots after each Edit/Write/Bash mutation; per-todo-step snapshots once per plan-todos.sh step boundary (cheaper, recommended). off is equivalent to enabled=false."
             },
@@ -836,7 +987,10 @@
             },
             "model": {
               "type": "string",
-              "enum": ["haiku", "sonnet"],
+              "enum": [
+                "haiku",
+                "sonnet"
+              ],
               "default": "haiku",
               "description": "Classifier model. Haiku is the cost default; Sonnet override for regulated domains where ambiguity nuance matters."
             },
@@ -856,7 +1010,11 @@
             },
             "autopilotMode": {
               "type": "string",
-              "enum": ["skip", "log", "abort"],
+              "enum": [
+                "skip",
+                "log",
+                "abort"
+              ],
               "default": "log",
               "description": "What to do when stopAndAsk fires in autopilot. skip = drop questions and proceed (most aggressive); log = append to agent-log.md and proceed (default, preserves signal); abort = pause Phase 0 and require multi-agent:resume."
             }
@@ -899,13 +1057,21 @@
             },
             "onExceed": {
               "type": "string",
-              "enum": ["warn", "halt"],
+              "enum": [
+                "warn",
+                "halt"
+              ],
               "default": "warn",
               "description": "warn = surface the overage and continue (autopilot keeps going). halt = pause the run and require multi-agent:resume once the user accepts the cost. Interactive runs always surface the line regardless."
             },
             "pricingModel": {
               "type": "string",
-              "enum": ["fable", "opus", "sonnet", "haiku"],
+              "enum": [
+                "fable",
+                "opus",
+                "sonnet",
+                "haiku"
+              ],
               "default": "fable",
               "description": "Which cost-table.json rate to price accumulated tokens at. Defaults to fable (the top tier since v10.6.0) for a deliberately conservative (upper-bound) estimate, so the ceiling trips early rather than late."
             }
@@ -996,7 +1162,11 @@
             },
             "model": {
               "type": "string",
-              "enum": ["sonnet", "opus", "haiku"],
+              "enum": [
+                "sonnet",
+                "opus",
+                "haiku"
+              ],
               "default": "sonnet",
               "description": "Critic model. Sonnet is the cost/quality default. Opus override only when diff > 500 LOC or touches security-critical paths. Haiku is too brittle for checklist reasoning - use only for trivial verification tasks."
             },
@@ -1099,7 +1269,10 @@
               "description": "When true, also scan the repo tree (not just the diff) for existing tests that already mention the symbol - catches gaps that are technically covered by older tests outside the current diff. Slower but more accurate. Off by default - diff-only scan is sufficient for the common case."
             },
             "blockingThreshold": {
-              "type": ["integer", "null"],
+              "type": [
+                "integer",
+                "null"
+              ],
               "minimum": 1,
               "default": null,
               "description": "If set, gaps where `important + blocking` count exceeds the threshold are treated as a Phase 4 rework finding (loops back to Phase 3). null = advisory only - Phase 5 prints the report but never gates."
@@ -1138,7 +1311,12 @@
           "items": {
             "type": "object",
             "additionalProperties": false,
-            "required": ["label", "localPath", "upstreamPlugin", "derivedFromVersion"],
+            "required": [
+              "label",
+              "localPath",
+              "upstreamPlugin",
+              "derivedFromVersion"
+            ],
             "properties": {
               "label": {
                 "type": "string",
@@ -1168,7 +1346,10 @@
                 "description": "Upstream version we last synced from, read from the manifest named by `upstreamVersionSource`. Bumped after a drift port is applied."
               },
               "upstreamVersionSource": {
-                "enum": ["marketplace.json", "plugin.json"],
+                "enum": [
+                  "marketplace.json",
+                  "plugin.json"
+                ],
                 "default": "marketplace.json",
                 "description": "Which upstream manifest carries the authoritative version. Defaults to marketplace.json because that is what a marketplace consumer resolves; some upstreams keep plugin.json deliberately unused, so reading it silently records a version nobody ships. Recording from the wrong manifest is how an entry here sat at 0.7.0 while the marketplace said 0.6.0."
               },
@@ -1179,6 +1360,11 @@
               "upstreamRepoUrl": {
                 "type": "string",
                 "description": "Used when neither a local clone nor the installed marketplace is available (WebFetch / gh fallback)."
+              },
+              "driftAcknowledged": {
+                "type": "string",
+                "pattern": "^\\d+\\.\\d+\\.\\d+$",
+                "description": "Upstream version whose drift is consciously accepted (port pending). The drift gate reports it but does not fail while upstream stays at this version; it re-fails the moment upstream moves past it."
               }
             }
           }
@@ -1212,7 +1398,11 @@
             },
             "registry": {
               "type": "string",
-              "enum": ["github-packages", "npmjs", "none"],
+              "enum": [
+                "github-packages",
+                "npmjs",
+                "none"
+              ],
               "default": "github-packages",
               "description": "Publish target for Step 3d. `none` means commit + push only, never publish. The concrete URL comes from the repo's publishConfig; the token comes from the `npm` logical Keychain key through a throwaway --userconfig."
             },
@@ -1228,7 +1418,9 @@
           "items": {
             "type": "object",
             "additionalProperties": false,
-            "required": ["id"],
+            "required": [
+              "id"
+            ],
             "properties": {
               "id": {
                 "type": "string",
@@ -1256,7 +1448,9 @@
           "items": {
             "type": "object",
             "additionalProperties": false,
-            "required": ["id"],
+            "required": [
+              "id"
+            ],
             "properties": {
               "id": {
                 "type": "string",
@@ -1279,7 +1473,12 @@
               },
               "defaultProvider": {
                 "type": "string",
-                "enum": ["github", "bitbucket", "gitlab", "generic-git"]
+                "enum": [
+                  "github",
+                  "bitbucket",
+                  "gitlab",
+                  "generic-git"
+                ]
               }
             }
           },
@@ -1297,15 +1496,15 @@
             }
           }
         },
-        "ship": {
+        "resumeLocal": {
           "type": "object",
           "additionalProperties": false,
-          "description": "v14.0.0+ - /multi-agent:ship (formerly :finish), the tail that runs review + build/test + PR + report over work already on the branch.",
+          "description": "/multi-agent:resume-local (formerly :ship, :finish) - the tail that runs review + build/test + PR + report over work already on the branch.",
           "properties": {
             "autoFix": {
               "type": "boolean",
               "default": false,
-              "description": "When true, ship auto-fixes triage-accepted blocking/important findings and re-reviews instead of asking. Equivalent to passing `autopilot` on every run. Default false: ship operates on work the user wrote by hand, so silently rewriting it is the surprising option."
+              "description": "When true, resume-local auto-fixes triage-accepted blocking/important findings and re-reviews instead of asking. Equivalent to passing `autopilot` on every run. Default false: resume-local operates on work the user wrote by hand, so silently rewriting it is the surprising option."
             }
           }
         }
@@ -1337,7 +1536,10 @@
             },
             "defaultPrMode": {
               "type": "string",
-              "enum": ["draft", "ready"],
+              "enum": [
+                "draft",
+                "ready"
+              ],
               "description": "Last-used draft/ready choice, shown as the default on next prompt."
             },
             "baseBranch": {
@@ -1376,7 +1578,12 @@
             },
             "remoteType": {
               "type": "string",
-              "enum": ["bitbucket", "github", "gitlab", "generic-git"],
+              "enum": [
+                "bitbucket",
+                "github",
+                "gitlab",
+                "generic-git"
+              ],
               "description": "Hint used when repo URL doesn't make platform obvious."
             },
             "taskCount": {
@@ -1430,7 +1637,10 @@
               "description": "Per-project App Store Connect delivery settings. Per-project rather than global because a user can ship for more than one team.",
               "properties": {
                 "providerPublicId": {
-                  "type": ["string", "null"],
+                  "type": [
+                    "string",
+                    "null"
+                  ],
                   "description": "Provider (team) public ID, required by altool when the account belongs to several providers. Resolve once with ios_testflight_validate({list_providers:true}); without it altool fails opaquely."
                 }
               }