@mmerterden/multi-agent-pipeline 20.0.0 → 20.2.0

package/pipeline/skills/shared/external/security-review/references/owasp-mobile-top10-2024.md

@@ -0,0 +1,53 @@
+# OWASP Mobile Top 10 2024 - review checklist with CWE mapping
+
+The category id (`M1:2024` .. `M10:2024`) goes in a finding's `security.owaspCategory`; the CWE that names the actual weakness goes in `security.cwe`. For the fuller mobile catalog that ties these to MASVS / MASTG and the store-compliance rules, the swift-security compliance mapping is the deeper reference; this is the review checklist.
+
+## M1:2024 - Improper Credential Usage
+
+Check: hardcoded API keys / passwords / tokens, credentials in source or resource files, credentials in logs, a secret shipped in the binary.
+CWEs: CWE-798 (hardcoded credentials), CWE-259, CWE-522.
+
+## M2:2024 - Inadequate Supply Chain Security
+
+Check: a dependency at a version with a known advisory, an unpinned SDK, a build step pulling an unverified artifact. This is the `security_dep_inventory` -> CVE path (`A06:2021`'s mobile analog).
+CWEs: CWE-1104, plus the advisory's CWE.
+
+## M3:2024 - Insecure Authentication/Authorization
+
+Check: auth decided client-side, a token accepted without verification, missing authorization on a sensitive action, biometric gate that only hides UI without protecting data.
+CWEs: CWE-287, CWE-306 (missing authentication), CWE-862, CWE-863.
+
+## M4:2024 - Insufficient Input/Output Validation
+
+Check: untrusted input into a SQL/content-provider query, a WebView `evaluateJavascript` / `postMessage` handler trusting page content, deep-link parameters used without validation, format-string or path built from input.
+CWEs: CWE-20, CWE-79 (WebView XSS), CWE-89, CWE-22.
+
+## M5:2024 - Insecure Communication
+
+Check: HTTP instead of HTTPS, disabled ATS / cleartext-traffic permitted, `TrustManager` that accepts all certs, missing certificate pinning on a sensitive endpoint, ignored TLS errors.
+CWEs: CWE-319 (cleartext), CWE-295 (improper certificate validation).
+
+## M6:2024 - Inadequate Privacy Controls
+
+Check: PII collected without need, location/contacts/identifiers sent off-device without disclosure, tracking before consent, PII in logs or analytics events.
+CWEs: CWE-359, CWE-200, CWE-532.
+
+## M7:2024 - Insufficient Binary Protections
+
+Check: no tamper/integrity check where the threat model needs one, debug symbols or verbose logging left in a release build, an easily-reversible secret embedded in the binary. Judge against the threat model - most apps do not need anti-reversing, and a `blocking` here needs a named attacker.
+CWEs: CWE-656, CWE-489 (debug code left in).
+
+## M8:2024 - Security Misconfiguration
+
+Check: an exported Android component with no permission, `android:debuggable=true` or `allowBackup=true` on sensitive data, an overly-broad entitlement, a permissive `network_security_config`, default or weak settings.
+CWEs: CWE-16, CWE-276 (incorrect default permissions), CWE-926 (improper export).
+
+## M9:2024 - Insecure Data Storage
+
+Check: sensitive data in `UserDefaults` / `SharedPreferences` / plist / plain files instead of the Keychain / Keystore, a database without encryption, a cache holding secrets, pasteboard leakage.
+CWEs: CWE-312 (cleartext storage), CWE-922 (insecure storage of sensitive info).
+
+## M10:2024 - Insufficient Cryptography
+
+Check: weak or deprecated algorithm (MD5/SHA1 for integrity, DES/ECB), a hardcoded key/IV, a home-rolled cipher, a predictable random source for a security purpose.
+CWEs: CWE-327 (broken/risky algorithm), CWE-326, CWE-330 (insufficient randomness), CWE-338.

package/pipeline/skills/shared/external/security-review/references/owasp-web-api-top10-2021.md

@@ -0,0 +1,56 @@
+# OWASP Top 10 2021 (Web / API) - review checklist with CWE mapping
+
+The category id (`A01:2021` .. `A10:2021`) goes in a finding's `security.owaspCategory`; the CWE most associated with the specific weakness goes in `security.cwe`. One weakness per finding. The CWEs listed per category are the common ones, not the whole set - pick the one that names the actual defect.
+
+## A01:2021 - Broken Access Control
+
+Check: missing authorization on a route or action, IDOR (object id from the request trusted without an ownership check), path traversal, forced browsing, CORS misconfiguration allowing credentialed cross-origin reads, privilege escalation through a mass-assignable field.
+CWEs: CWE-284, CWE-285, CWE-639 (IDOR), CWE-862 (missing authorization), CWE-863 (incorrect authorization), CWE-22 (path traversal), CWE-352 (CSRF).
+Evidence to cite: the handler that reads an id from input and queries without a `where owner = current_user` predicate; a route with no auth middleware.
+
+## A02:2021 - Cryptographic Failures
+
+Check: secrets or PII sent or stored in clear, weak or deprecated algorithms (MD5, SHA1 for passwords, DES, ECB), hardcoded keys, missing TLS, disabled certificate validation, predictable IVs/nonces, passwords hashed without a slow KDF (bcrypt/scrypt/argon2).
+CWEs: CWE-311 (missing encryption), CWE-319 (cleartext transmission), CWE-327 (broken/risky algorithm), CWE-326 (inadequate strength), CWE-798 (hardcoded credentials), CWE-916 (weak password hash).
+
+## A03:2021 - Injection
+
+Check: SQL/NoSQL/ORM query built by string concatenation of untrusted input, OS command built from input, LDAP/XPath injection, unsanitized input reflected into HTML (XSS), template injection, header injection.
+CWEs: CWE-89 (SQL), CWE-78 (OS command), CWE-79 (XSS), CWE-90 (LDAP), CWE-94 (code injection), CWE-943 (NoSQL/query).
+Evidence: the untrusted source and the sink on the same path, with no parameterization or encoding between.
+
+## A04:2021 - Insecure Design
+
+Check: a missing control the design needed - no rate limit on a credential endpoint, no anti-automation on a costly action, trust placed in a client-supplied value that decides server behaviour, a workflow that can be replayed.
+CWEs: CWE-73, CWE-183, CWE-209 (info leak by design), CWE-256, CWE-501 (trust boundary violation), CWE-522.
+
+## A05:2021 - Security Misconfiguration
+
+Check: debug or verbose errors in production, default credentials, an unnecessary feature or port enabled, permissive CORS, missing security headers (CSP, HSTS, X-Content-Type-Options), directory listing, an overly-permissive cloud bucket or IAM policy in config.
+CWEs: CWE-16, CWE-611 (XXE), CWE-732 (incorrect permissions), CWE-1032, CWE-756.
+
+## A06:2021 - Vulnerable and Outdated Components
+
+Check: a dependency at a version with a known advisory. This is the `security_dep_inventory` -> CVE-lookup path. Carry the `cve` and the advisory's CWE; put the finding on the manifest at line 0.
+CWEs: CWE-1104, plus the advisory's own CWE.
+
+## A07:2021 - Identification and Authentication Failures
+
+Check: credential stuffing possible (no throttle/lockout), weak password policy, session id in the URL, session not rotated on login, missing or weak MFA, JWT with `alg:none` accepted or signature not verified, long-lived non-revocable tokens.
+CWEs: CWE-287 (improper auth), CWE-297, CWE-384 (session fixation), CWE-521 (weak password), CWE-613 (insufficient expiration), CWE-347 (improper signature verification).
+
+## A08:2021 - Software and Data Integrity Failures
+
+Check: insecure deserialization of untrusted data, an update or plugin loaded without signature verification, a CI/CD step pulling an unpinned or unverified artifact, client-side data trusted without integrity check.
+CWEs: CWE-502 (deserialization), CWE-345, CWE-494 (download without integrity check), CWE-829.
+
+## A09:2021 - Security Logging and Monitoring Failures
+
+Check: security-relevant events not logged (auth failures, access-control denials, high-value actions), logs containing secrets or PII, no alerting path. Note it as a `suggestion`/`important` gap, rarely `blocking` on its own.
+CWEs: CWE-778 (insufficient logging), CWE-532 (secrets in logs), CWE-223.
+
+## A10:2021 - Server-Side Request Forgery (SSRF)
+
+Check: the server fetches a URL built from user input without an allowlist, letting a caller reach internal services, cloud metadata endpoints, or the loopback interface.
+CWEs: CWE-918.
+Evidence: the input-derived URL reaching an HTTP client with no host allowlist or scheme restriction.

package/pipeline/skills/shared/external/storekit/SKILL.md

@@ -16,6 +16,10 @@ When reviewing StoreKit code, explicitly separate "preferred SwiftUI path" from
 direct `product.purchase(options:)` is still valid for lower-level custom
 StoreKit flows.
 
+Full, copyable code for the core flows lives in
+[references/core-patterns.md](references/core-patterns.md). This guide keeps the
+review guidance and short snippets; load the reference for a complete example.
+
 ## Contents
 
 - [Implementation Review Minimums](#implementation-review-minimums)
@@ -24,11 +28,10 @@ StoreKit flows.
 - [Purchase Flow](#purchase-flow)
 - [Transaction.updates Listener](#transactionupdates-listener)
 - [Entitlement Checking](#entitlement-checking)
-- [SubscriptionStoreView (iOS 17+)](#subscriptionstoreview-ios-17)
-- [StoreView (iOS 17+)](#storeview-ios-17)
+- [Store Views (SubscriptionStoreView, StoreView, ProductView)](#store-views-subscriptionstoreview-storeview-productview)
 - [Subscription Status Checking](#subscription-status-checking)
 - [Restore Purchases](#restore-purchases)
-- [App Transaction (App Purchase Verification)](#app-transaction-app-purchase-verification)
+- [App Transaction](#app-transaction)
 - [Purchase Options](#purchase-options)
 - [SwiftUI Purchase Callbacks](#swiftui-purchase-callbacks)
 - [Common Mistakes](#common-mistakes)
@@ -76,20 +79,13 @@ points explicitly:
 Define product IDs as constants. Fetch products with `Product.products(for:)`.
 
 ```swift
-import StoreKit
-
 enum ProductID {
     static let premium = "com.myapp.premium"
-    static let gems100 = "com.myapp.gems100"
     static let monthlyPlan = "com.myapp.monthly"
-    static let yearlyPlan = "com.myapp.yearly"
-    static let all: [String] = [premium, gems100, monthlyPlan, yearlyPlan]
+    static let all: [String] = [premium, monthlyPlan]
 }
 
 let products = try await Product.products(for: ProductID.all)
-for product in products {
-    print("\(product.displayName): \(product.displayPrice)")
-}
 ```
 
 ## Purchase Flow
@@ -105,35 +101,8 @@ Review wording: do not call `product.purchase(options:)` inherently wrong. Say
 "prefer `PurchaseAction` for SwiftUI buttons; keep `product.purchase(options:)`
 for lower-level custom flows that need direct StoreKit control."
 
-```swift
-@Environment(\.purchase) private var purchase
-
-func purchaseProduct(_ product: Product) async throws {
-    let result = try await purchase(product, options: [
-        .appAccountToken(userAccountToken)
-    ])
-    switch result {
-    case .success(let verification):
-        let transaction = try checkVerified(verification)
-        await deliverContent(for: transaction)
-        await transaction.finish()
-    case .userCancelled:
-        break
-    case .pending:
-        // Ask to Buy or deferred approval: show pending UI, no unlock yet.
-        showPendingApprovalMessage()
-    @unknown default:
-        break
-    }
-}
-
-func checkVerified<T>(_ result: VerificationResult<T>) throws -> T {
-    switch result {
-    case .verified(let value): return value
-    case .unverified(_, let error): throw error
-    }
-}
-```
+Full purchase-flow example with `checkVerified` and `.pending` handling:
+references/core-patterns.md#purchase-flow
 
 ## Transaction.updates Listener
 
@@ -146,30 +115,8 @@ In implementation reviews, name the launch-time coverage explicitly: purchases
 made on other devices, Family Sharing changes, subscription renewals, Ask to Buy
 approvals, refunds, revocations, and unfinished transactions.
 
-```swift
-@main
-struct MyApp: App {
-    private let transactionListener: Task<Void, Never>
-
-    init() {
-        transactionListener = Self.listenForTransactions()
-    }
-
-    var body: some Scene {
-        WindowGroup { ContentView() }
-    }
-
-    static func listenForTransactions() -> Task<Void, Never> {
-        Task(priority: .background) {
-            for await result in Transaction.updates {
-                guard case .verified(let transaction) = result else { continue }
-                await StoreManager.shared.updateEntitlements()
-                await transaction.finish()
-            }
-        }
-    }
-}
-```
+Full launch-time listener wired into `App.init`:
+references/core-patterns.md#transactionupdates-listener
 
 ## Entitlement Checking
 
@@ -185,144 +132,35 @@ covers non-consumables, active or grace-period auto-renewable subscriptions, and
 non-renewing subscriptions; it does not include consumable purchase or delivery
 history." Do not replace this with only a code sample or a revocation check.
 
-```swift
-@Observable
-@MainActor
-class StoreManager {
-    static let shared = StoreManager()
-    var purchasedProductIDs: Set<String> = []
-    var isPremium: Bool { purchasedProductIDs.contains(ProductID.premium) }
-
-    func updateEntitlements() async {
-        var purchased = Set<String>()
-        for await result in Transaction.currentEntitlements {
-            if case .verified(let transaction) = result,
-               transaction.revocationDate == nil {
-                purchased.insert(transaction.productID)
-            }
-        }
-        purchasedProductIDs = purchased
-    }
-}
-```
+Full `StoreManager.updateEntitlements()` and the `.currentEntitlementTask`
+SwiftUI gate: references/core-patterns.md#entitlement-checking
 
-### SwiftUI .currentEntitlementTask Modifier
+## Store Views (SubscriptionStoreView, StoreView, ProductView)
 
-```swift
-struct PremiumGatedView: View {
-    @State private var state: EntitlementTaskState<VerificationResult<Transaction>?> = .loading
-
-    var body: some View {
-        Group {
-            switch state {
-            case .loading: ProgressView()
-            case .failure: PaywallView()
-            case .success(.some(.verified(let transaction))) where transaction.revocationDate == nil:
-                PremiumContentView()
-            case .success:
-                PaywallView()
-            }
-        }
-        .currentEntitlementTask(for: ProductID.premium) { state in
-            self.state = state
-        }
-    }
-}
-```
-
-## SubscriptionStoreView (iOS 17+)
-
-Built-in SwiftUI view for subscription paywalls. Handles product loading,
-purchase UI, and restore purchases automatically.
+`SubscriptionStoreView(groupID:)` is the built-in subscription paywall; it loads
+products, runs the purchase UI, and can expose restore and policy controls.
+`StoreView(ids:)` merchandises multiple products, and `ProductView(id:)` renders
+a single product. All expose `.onInAppPurchaseCompletion` and
+`.storeButton(.visible, for: .restorePurchases)`.
 
 ```swift
 SubscriptionStoreView(groupID: "YOUR_GROUP_ID")
-    .subscriptionStoreControlStyle(.prominentPicker)
-    .subscriptionStoreButtonLabel(.multiline)
     .storeButton(.visible, for: .restorePurchases)
-    .storeButton(.visible, for: .redeemCode)
     .subscriptionStorePolicyDestination(url: termsURL, for: .termsOfService)
     .subscriptionStorePolicyDestination(url: privacyURL, for: .privacyPolicy)
-    .onInAppPurchaseCompletion { product, result in
-        if case .success(.success(.verified(let transaction))) = result {
-            await deliverContent(for: transaction)
-            await transaction.finish()
-        }
-    }
-```
-
-### Custom Marketing Content
-
-```swift
-SubscriptionStoreView(groupID: "YOUR_GROUP_ID") {
-    VStack {
-        Image(systemName: "crown.fill").font(.system(size: 60)).foregroundStyle(.yellow)
-        Text("Unlock Premium").font(.largeTitle.bold())
-        Text("Access all features").foregroundStyle(.secondary)
-    }
-}
-.containerBackground(.blue.gradient, for: .subscriptionStore)
-```
-
-### Hierarchical Layout
-
-`SubscriptionOptionGroup`, `SubscriptionOptionSection`, and
-`SubscriptionPeriodGroupSet` are iOS 18+ helper views for organizing options
-inside `SubscriptionStoreView`.
-
-```swift
-SubscriptionStoreView(groupID: "YOUR_GROUP_ID") {
-    SubscriptionPeriodGroupSet()
-}
-.subscriptionStoreControlStyle(.picker)
-```
-
-## StoreView (iOS 17+)
-
-Merchandises multiple products with localized names, prices, and purchase buttons.
-
-```swift
-StoreView(ids: [ProductID.gems100, ProductID.premium], prefersPromotionalIcon: true)
-    .productViewStyle(.large)
-    .storeButton(.visible, for: .restorePurchases)
-    .onInAppPurchaseCompletion { product, result in
-        if case .success(.success(.verified(let transaction))) = result {
-            await deliverContent(for: transaction)
-            await transaction.finish()
-        }
-    }
 ```
 
-### ProductView for Individual Products
+Full paywall, custom marketing content, `StoreView`, and `ProductView` examples:
+references/core-patterns.md#subscriptionstoreview and
+references/core-patterns.md#storeview-and-productview
 
-```swift
-ProductView(id: ProductID.premium) { iconPhase in
-    switch iconPhase {
-    case .success(let image): image.resizable().scaledToFit()
-    case .loading: ProgressView()
-    default: Image(systemName: "star.fill")
-    }
-}
-.productViewStyle(.large)
-```
+For control styles, hierarchical option layouts, offers, and container
+backgrounds see [references/storekit-advanced.md](references/storekit-advanced.md).
 
 ## Subscription Status Checking
 
-```swift
-func checkSubscriptionActive(groupID: String) async throws -> Bool {
-    let statuses = try await Product.SubscriptionInfo.status(for: groupID)
-    for status in statuses {
-        guard case .verified = status.renewalInfo,
-              case .verified = status.transaction else { continue }
-        if status.state == .subscribed || status.state == .inGracePeriod {
-            return true
-        }
-    }
-    return false
-}
-```
-
-### Renewal States
+Read status with `Product.SubscriptionInfo.status(for: groupID)`; treat
+`.subscribed` and `.inGracePeriod` as active.
 
 | State | Meaning |
 |---|---|
@@ -332,6 +170,10 @@ func checkSubscriptionActive(groupID: String) async throws -> Bool {
 | `.inGracePeriod` | Payment failed but access continues during grace period |
 | `.revoked` | Apple refunded or revoked the subscription |
 
+Full status-check helper: references/core-patterns.md#subscription-status-checking.
+For renewal-state access decisions, expiration reasons, grace period, and billing
+retry see [references/storekit-advanced.md](references/storekit-advanced.md).
+
 ## Restore Purchases
 
 StoreKit 2 handles restoration via `Transaction.currentEntitlements`. Add a
@@ -346,173 +188,46 @@ func restorePurchases() async throws {
 
 On store views: `.storeButton(.visible, for: .restorePurchases)`
 
-## App Transaction (App Purchase Verification)
+## App Transaction
 
-Verify the legitimacy of the app installation. Use for business model changes
-or detecting tampered installations (iOS 16+).
+Verify the legitimacy of the app installation with `AppTransaction.shared`. Use
+for business model changes or detecting tampered installations (iOS 16+); read
+`originalAppVersion` / `originalPurchaseDate` on the verified result and restrict
+features on `.unverified`.
 
-```swift
-func verifyAppPurchase() async {
-    do {
-        let result = try await AppTransaction.shared
-        switch result {
-        case .verified(let appTransaction):
-            let originalVersion = appTransaction.originalAppVersion
-            let purchaseDate = appTransaction.originalPurchaseDate
-            // Migration logic for users who paid before subscription model
-        case .unverified:
-            // Potentially tampered -- restrict features as appropriate
-            break
-        }
-    } catch { /* Could not retrieve app transaction */ }
-}
-```
+Full `verifyAppPurchase()` example: references/core-patterns.md#app-transaction
 
 ## Purchase Options
 
 ```swift
-// App account token for server-side reconciliation
-try await product.purchase(options: [.appAccountToken(UUID())])
-
-// Consumable quantity
-try await product.purchase(options: [.quantity(5)])
-
-// Simulate Ask to Buy in sandbox
-try await product.purchase(options: [.simulatesAskToBuyInSandbox(true)])
+try await product.purchase(options: [.appAccountToken(UUID())]) // server reconciliation
+try await product.purchase(options: [.quantity(5)])             // consumable quantity
+try await product.purchase(options: [.simulatesAskToBuyInSandbox(true)]) // sandbox
 ```
 
 ## SwiftUI Purchase Callbacks
 
-```swift
-.onInAppPurchaseStart { product in
-    await analytics.trackPurchaseStarted(product.id)
-}
-.onInAppPurchaseCompletion { product, result in
-    if case .success(.success(.verified(let transaction))) = result {
-        await deliverContent(for: transaction)
-        await transaction.finish()
-    }
-}
-.inAppPurchaseOptions { product in
-    [.appAccountToken(userAccountToken)]
-}
-```
+Store views expose `.onInAppPurchaseStart`, `.onInAppPurchaseCompletion`, and
+`.inAppPurchaseOptions`. In the completion handler, verify the transaction,
+deliver content, then `finish()`.
 
-## Common Mistakes
-
-### 1. Not starting Transaction.updates at app launch
-
-```swift
-// WRONG: No listener -- misses renewals, refunds, Ask to Buy approvals
-@main struct MyApp: App {
-    var body: some Scene { WindowGroup { ContentView() } }
-}
-// CORRECT: Start listener in App init (see Transaction.updates section above)
-```
-
-### 2. Forgetting transaction.finish()
-
-```swift
-// WRONG: Never finished -- reappears in unfinished queue forever
-let transaction = try checkVerified(verification)
-unlockFeature(transaction.productID)
-
-// CORRECT: Deliver durably, then finish. If delivery fails, do not finish yet.
-let transaction = try checkVerified(verification)
-try await recordDelivery(transaction)
-await transaction.finish()
-```
-
-### 3. Ignoring verification result
-
-```swift
-// WRONG: Using unverified transaction -- security risk
-let transaction = verification.unsafePayloadValue
-
-// CORRECT: Verify before using
-let transaction = try checkVerified(verification)
-```
-
-### 4. Using original In-App Purchase APIs in new StoreKit 2 code
-
-```swift
-// AVOID: Original In-App Purchase APIs
-let request = SKProductsRequest(productIdentifiers: ["com.app.premium"])
-SKPaymentQueue.default().add(payment)
-
-// PREFERRED: StoreKit 2
-let products = try await Product.products(for: ["com.app.premium"])
-let result = try await product.purchase()
-```
-
-### 5. Not checking revocationDate
-
-```swift
-// WRONG: Grants access to refunded purchases
-if case .verified(let transaction) = result {
-    purchased.insert(transaction.productID)
-}
-
-// CORRECT: Skip revoked transactions
-if case .verified(let transaction) = result, transaction.revocationDate == nil {
-    purchased.insert(transaction.productID)
-}
-```
+Full callback example: references/core-patterns.md#swiftui-purchase-callbacks
 
-### 6. Hardcoding prices
-
-```swift
-// WRONG: Wrong for other currencies and regions
-Text("Buy Premium for $4.99")
-
-// CORRECT: Localized price from Product
-Text("Buy \(product.displayName) for \(product.displayPrice)")
-```
-
-### 7. Not handling .pending purchase result
-
-```swift
-// WRONG: Silently drops pending Ask to Buy
-default: break
-
-// CORRECT: Explain approval is pending; unlock only after Transaction.updates
-case .pending:
-    showPendingApprovalMessage()
-```
-
-### 8. Checking entitlements only once at launch
-
-```swift
-// WRONG: Check once, never update
-func appDidFinish() { Task { await updateEntitlements() } }
-
-// CORRECT: Re-check on Transaction.updates AND on foreground return
-// Transaction.updates listener handles mid-session changes.
-// Also use .task { await storeManager.updateEntitlements() } on content views.
-```
-
-### 9. Missing restore purchases button
-
-```swift
-// WRONG: No restore option -- App Store rejection risk
-SubscriptionStoreView(groupID: "group_id")
-
-// CORRECT
-SubscriptionStoreView(groupID: "group_id")
-    .storeButton(.visible, for: .restorePurchases)
-```
-
-### 10. Subscription views without policy links
+## Common Mistakes
 
-```swift
-// WRONG: No terms or privacy policy
-SubscriptionStoreView(groupID: "group_id")
+The ten most common StoreKit 2 defects, each with a WRONG/CORRECT example, are in
+references/core-patterns.md#common-mistakes:
 
-// CORRECT
-SubscriptionStoreView(groupID: "group_id")
-    .subscriptionStorePolicyDestination(url: termsURL, for: .termsOfService)
-    .subscriptionStorePolicyDestination(url: privacyURL, for: .privacyPolicy)
-```
+1. Not starting `Transaction.updates` at app launch
+2. Forgetting `transaction.finish()`
+3. Ignoring the verification result
+4. Using original In-App Purchase APIs in new StoreKit 2 code
+5. Not checking `revocationDate`
+6. Hardcoding prices instead of `product.displayPrice`
+7. Not handling the `.pending` purchase result
+8. Checking entitlements only once at launch
+9. Missing restore purchases button
+10. Subscription views without Terms / Privacy policy links
 
 ## Review Checklist
 
@@ -536,8 +251,19 @@ SubscriptionStoreView(groupID: "group_id")
 
 ## References
 
-- See [references/app-review-guidelines.md](references/app-review-guidelines.md) for IAP rules (Guideline 3.1.1), subscription display requirements, and rejection prevention.
-- See [references/storekit-advanced.md](references/storekit-advanced.md) for subscription control styles, offer management, testing patterns, and advanced subscription handling.
+- See [references/core-patterns.md](references/core-patterns.md) for full core
+  code: purchase flow, launch-time transaction listener, entitlement checking,
+  store views, subscription status, app transaction, purchase callbacks, and the
+  ten annotated common mistakes. Load it when writing or reviewing a core flow.
+- See [references/storekit-advanced.md](references/storekit-advanced.md) for
+  subscription control styles, offer management (introductory, promotional,
+  win-back, offer codes), server-side validation, StoreKit testing, renewal
+  states, grace period/billing retry, refunds, and Family Sharing. Load it for
+  offers, testing setup, or advanced subscription handling.
+- See [references/app-review-guidelines.md](references/app-review-guidelines.md)
+  for IAP rules (Guideline 3.1.1), subscription display requirements, and
+  rejection prevention. Load it before a submission or when diagnosing a payment
+  rejection.
 - For submission, privacy, metadata, screenshots, and rejection-risk audits use `app-store-review`.
 - For keyword, screenshot-caption, ranking, and conversion strategy use `app-store-optimization`.
 - Official Apple docs: [Choosing a StoreKit API](https://sosumi.ai/documentation/storekit/choosing-a-storekit-api-for-in-app-purchases), [Transaction.updates](https://sosumi.ai/documentation/storekit/transaction/updates), [Transaction.currentEntitlements](https://sosumi.ai/documentation/storekit/transaction/currententitlements),