@mmerterden/multi-agent-pipeline 20.33.0 → 20.35.0

package/pipeline/skills/shared/external/swift-charts/references/charts-patterns.md

@@ -1,5 +1,29 @@
 # Swift Charts Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Modelling the Data](#modelling-the-data)
+- [Bars](#bars)
+- [Lines](#lines)
+- [Pies and Donuts](#pies-and-donuts)
+- [Combining Marks](#combining-marks)
+- [A Tooltip on Selection](#a-tooltip-on-selection)
+- [Scrolling with a Bound Position](#scrolling-with-a-bound-position)
+- [Function Plots (iOS 18)](#function-plots-ios-18)
+- [3D Charts and Surfaces (iOS 26)](#3d-charts-and-surfaces-ios-26)
+- [Accessibility](#accessibility)
+- [Dynamic Type and Colour](#dynamic-type-and-colour)
+- [Performance: When to Vectorize](#performance-when-to-vectorize)
+- [Dark Mode and Theming](#dark-mode-and-theming)
+- [Heat Map](#heat-map)
+- [Stacking](#stacking)
+- [`MarkDimension`](#markdimension)
+- [Symbols](#symbols)
+- [`ChartProxy` and Coordinates](#chartproxy-and-coordinates)
+- [Modifier Quick Reference](#modifier-quick-reference)
+- [Apple Documentation](#apple-documentation)
+<!-- /toc -->
+
 Companion to the `swift-charts` skill. Any source file touching these types
 imports `Charts` next to `SwiftUI`.
 

package/pipeline/skills/shared/external/swift-concurrency/references/bridging-interop.md

@@ -1,5 +1,13 @@
 # Bridging Callbacks, Delegates and GCD
 
+<!-- toc -->
+- [Checked continuations](#checked-continuations)
+- [Bridging a delegate](#bridging-a-delegate)
+- [Passing cancellation through](#passing-cancellation-through)
+- [Streams from repeating callbacks](#streams-from-repeating-callbacks)
+- [Replacing GCD](#replacing-gcd)
+<!-- /toc -->
+
 ## Checked continuations
 
 `withCheckedContinuation` (non-throwing) and `withCheckedThrowingContinuation`

package/pipeline/skills/shared/external/swift-concurrency/references/concurrency-patterns.md

@@ -1,5 +1,19 @@
 # Approachable Concurrency Patterns
 
+<!-- toc -->
+- [What problem 6.2 fixed](#what-problem-62-fixed)
+- [Default MainActor isolation (SE-0466)](#default-mainactor-isolation-se-0466)
+- [Async functions run on the caller (SE-0461)](#async-functions-run-on-the-caller-se-0461)
+- [Leaving the caller with `@concurrent`](#leaving-the-caller-with-concurrent)
+- [Starting without a queue hop (SE-0472)](#starting-without-a-queue-hop-se-0472)
+- [Isolated conformances](#isolated-conformances)
+- [Immutable weak references (SE-0481)](#immutable-weak-references-se-0481)
+- [Transactional observation (SE-0475)](#transactional-observation-se-0475)
+- [Global and static state](#global-and-static-state)
+- [Build settings and migration](#build-settings-and-migration)
+- [The progression](#the-progression)
+<!-- /toc -->
+
 Swift 6.2 lets a target start out effectively single-threaded: with both
 Default Actor Isolation set to `MainActor` and Approachable Concurrency turned
 on, code runs on the main actor until you introduce parallelism deliberately.

package/pipeline/skills/shared/external/swift-concurrency/references/swiftui-concurrency.md

@@ -1,5 +1,17 @@
 # SwiftUI and Concurrency
 
+<!-- toc -->
+- [Views live on the main actor](#views-live-on-the-main-actor)
+- [Callbacks SwiftUI may run off the main thread](#callbacks-swiftui-may-run-off-the-main-thread)
+- [Reading state inside a Sendable closure](#reading-state-inside-a-sendable-closure)
+- [Structuring async work](#structuring-async-work)
+- [The `.task` modifier](#the-task-modifier)
+- [Observable view models](#observable-view-models)
+- [Reacting to model changes with Observations](#reacting-to-model-changes-with-observations)
+- [Concurrency for performance](#concurrency-for-performance)
+- [Mistakes](#mistakes)
+<!-- /toc -->
+
 ## Views live on the main actor
 
 The `View` protocol is isolated to `@MainActor` (from the iOS 18 SDK on; older

package/pipeline/skills/shared/external/swift-concurrency/references/synchronization-primitives.md

@@ -1,5 +1,15 @@
 # Synchronization Primitives
 
+<!-- toc -->
+- [Mutex](#mutex)
+- [OSAllocatedUnfairLock](#osallocatedunfairlock)
+- [Mutex or OSAllocatedUnfairLock](#mutex-or-osallocatedunfairlock)
+- [Atomic](#atomic)
+- [Locks or actors](#locks-or-actors)
+- [Decision guide](#decision-guide)
+- [Anti-patterns](#anti-patterns)
+<!-- /toc -->
+
 When an actor is the wrong shape for some shared mutable state, these types
 protect it instead. Each one is `Sendable` and safe to use from any thread.
 

package/pipeline/skills/shared/external/swift-concurrency-expert/references/swift-6-2-concurrency.md

@@ -1,5 +1,13 @@
 ## Concurrent programming updates in Swift 6.2
 
+<!-- toc -->
+- [Concurrent programming updates in Swift 6.2](#concurrent-programming-updates-in-swift-62)
+- [Data-race safety](#data-race-safety)
+- [Global State](#global-state)
+- [Offloading work to the background](#offloading-work-to-the-background)
+- [Summary](#summary)
+<!-- /toc -->
+
 Concurrent programming is hard because sharing memory between multiple tasks is prone to mistakes that lead to unpredictable behavior.
 
 ## Data-race safety

package/pipeline/skills/shared/external/swift-concurrency-pro/references/actors.md

@@ -1,5 +1,15 @@
 # Actors
 
+<!-- toc -->
+- [Reentrancy](#reentrancy)
+- [Protecting global and static state](#protecting-global-and-static-state)
+- [Global actor inference rules](#global-actor-inference-rules)
+- [`isolated` parameters](#isolated-parameters)
+- [`isolated deinit`](#isolated-deinit)
+- [What a custom actor changes](#what-a-custom-actor-changes)
+- [Making assertions](#making-assertions)
+<!-- /toc -->
+
 ## Reentrancy
 
 **Important:** This is the most common concurrency bug LLMs produce: after every `await` inside an actor, all assumptions about the actor's state are invalidated because other calls may have run in the meantime.

package/pipeline/skills/shared/external/swift-concurrency-pro/references/cancellation.md

@@ -1,5 +1,12 @@
 # Cancellation
 
+<!-- toc -->
+- [How cancellation propagates](#how-cancellation-propagates)
+- [Checking for cancellation](#checking-for-cancellation)
+- [`withTaskCancellationHandler`](#withtaskcancellationhandler)
+- [Broken cancellation patterns](#broken-cancellation-patterns)
+<!-- /toc -->
+
 Cancellation in Swift concurrency is cooperative. Setting the cancelled flag does nothing unless the running code checks it.
 
 ## How cancellation propagates

package/pipeline/skills/shared/external/swift-concurrency-pro/references/interop.md

@@ -1,5 +1,15 @@
 # Interop and migration
 
+<!-- toc -->
+- [Completion handlers → `async`/`await`](#completion-handlers-asyncawait)
+- [Delegates → `AsyncStream`](#delegates-asyncstream)
+- [`DispatchQueue.main.async` → `@MainActor`](#dispatchqueuemainasync-mainactor)
+- [`DispatchQueue.global().async` → `@concurrent` or Task Group](#dispatchqueueglobalasync-concurrent-or-task-group)
+- [Serial `DispatchQueue` → `actor`](#serial-dispatchqueue-actor)
+- [Locks and checked sendability](#locks-and-checked-sendability)
+- [Moving from Combine to `AsyncSequence`](#moving-from-combine-to-asyncsequence)
+<!-- /toc -->
+
 Approved patterns for migrating legacy concurrency mechanisms to Swift concurrency.
 
 ## Completion handlers → `async`/`await`

package/pipeline/skills/shared/external/swift-concurrency-pro/references/new-features.md

@@ -1,5 +1,16 @@
 # Swift 6.2 concurrency
 
+<!-- toc -->
+- [Control default actor isolation inference](#control-default-actor-isolation-inference)
+- [Global-actor isolated conformances](#global-actor-isolated-conformances)
+- [Run `nonisolated` async functions on the caller's actor by default](#run-nonisolated-async-functions-on-the-callers-actor-by-default)
+- [Offloading work with `@concurrent`](#offloading-work-with-concurrent)
+- [Starting tasks synchronously from caller context](#starting-tasks-synchronously-from-caller-context)
+- [Isolated deinit](#isolated-deinit)
+- [Task priority escalation APIs](#task-priority-escalation-apis)
+- [Task naming](#task-naming)
+<!-- /toc -->
+
 Use this file for recent concurrency changes that materially affect review advice.
 
 ## Control default actor isolation inference

package/pipeline/skills/shared/external/swift-concurrency-pro/references/structured.md

@@ -1,5 +1,14 @@
 # Structured concurrency
 
+<!-- toc -->
+- [`async let` vs task groups](#async-let-vs-task-groups)
+- [Task groups over loops](#task-groups-over-loops)
+- [`withDiscardingTaskGroup` (Swift 5.9+)](#withdiscardingtaskgroup-swift-59)
+- [Limiting concurrency](#limiting-concurrency)
+- [Error handling with partial results](#error-handling-with-partial-results)
+- [Inferring the type of task groups](#inferring-the-type-of-task-groups)
+<!-- /toc -->
+
 ## `async let` vs task groups
 
 Use `async let` when you have a fixed number of independent operations that return different types, e.g. fetching the news, the weather, and an app update at the same time. Use task groups when you have a dynamic number of operations of the same type, e.g. downloading all images in an array of URLs.

package/pipeline/skills/shared/external/swift-concurrency-pro/references/testing.md

@@ -1,5 +1,18 @@
 # Testing concurrent code
 
+<!-- toc -->
+- [Async tests with Swift Testing](#async-tests-with-swift-testing)
+- [Testing actor state](#testing-actor-state)
+- [The `.serialized` trait and concurrent tests](#the-serialized-trait-and-concurrent-tests)
+- [Confirmation for async events](#confirmation-for-async-events)
+- [Actor isolation in tests](#actor-isolation-in-tests)
+- [Test scoping traits with `@TaskLocal`](#test-scoping-traits-with-tasklocal)
+- [Avoid timing-based tests](#avoid-timing-based-tests)
+- [Testing cancellation](#testing-cancellation)
+- [Race detection](#race-detection)
+- [Swift Testing + Swift concurrency](#swift-testing-swift-concurrency)
+<!-- /toc -->
+
 ## Async tests with Swift Testing
 
 Swift Testing supports async test functions natively. No special setup required:

package/pipeline/skills/shared/external/swift-language/references/swift-attributes-interop.md

@@ -1,5 +1,12 @@
 # Swift 6.3 attributes for interop, performance and layout
 
+<!-- toc -->
+- [@c](#c)
+- [Module selectors](#module-selectors)
+- [Performance annotations](#performance-annotations)
+- [Symbol visibility and layout](#symbol-visibility-and-layout)
+<!-- /toc -->
+
 Attributes that became official in Swift 6.3. Each section names the Swift
 Evolution proposal so the exact rules can be checked there.
 

package/pipeline/skills/shared/external/swift-language/references/swift-patterns-extended.md

@@ -1,5 +1,19 @@
 # Extended Swift patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Codable](#codable)
+- [Result builders](#result-builders)
+- [Property wrappers](#property-wrappers)
+- [Advanced Regex](#advanced-regex)
+- [Custom FormatStyle](#custom-formatstyle)
+- [Collection patterns](#collection-patterns)
+- [guard: complex pattern matching](#guard-complex-pattern-matching)
+- [Typed throws in protocols](#typed-throws-in-protocols)
+- [String interpolation](#string-interpolation)
+- [Never: advanced usage](#never-advanced-usage)
+<!-- /toc -->
+
 Longer examples behind the main skill. Deep Codable work still belongs to
 `swift-codable`, and format styles beyond a custom style to `swift-formatstyle`.
 

package/pipeline/skills/shared/external/swift-security/references/biometric-authentication.md

@@ -1,5 +1,21 @@
 # Biometric Authentication
 
+<!-- toc -->
+- [Contents](#contents)
+- [Why a Boolean Gate Fails](#why-a-boolean-gate-fails)
+- [The Secure Pattern: Let the Keychain Ask](#the-secure-pattern-let-the-keychain-ask)
+- [evaluatePolicy and evaluateAccessControl](#evaluatepolicy-and-evaluateaccesscontrol)
+- [Which Flag](#which-flag)
+- [Availability and Degradation](#availability-and-degradation)
+- [Detecting Enrollment Changes](#detecting-enrollment-changes)
+- [Threads and async/await](#threads-and-asyncawait)
+- [Secure Enclave Keys Behind Biometrics](#secure-enclave-keys-behind-biometrics)
+- [Controls in the Development Process](#controls-in-the-development-process)
+- [Verifying at Runtime](#verifying-at-runtime)
+- [Checklist](#checklist)
+- [Sources and Related Files](#sources-and-related-files)
+<!-- /toc -->
+
 Severity when violated: **CRITICAL.** Of all the insecure patterns that code
 generators produce, a lone `LAContext.evaluatePolicy()` call guarding sensitive
 content is the most dangerous, because it can be defeated at runtime without

package/pipeline/skills/shared/external/swift-security/references/certificate-trust.md

@@ -1,5 +1,22 @@
 # Certificate Trust, Pinning and Client Certificates
 
+<!-- toc -->
+- [Contents](#contents)
+- [The four types](#the-four-types)
+- [Evaluating trust](#evaluating-trust)
+- [Custom policies and anchors](#custom-policies-and-anchors)
+- [Four ways to pin](#four-ways-to-pin)
+- [Certificates and identities](#certificates-and-identities)
+- [Mistakes to reject in review](#mistakes-to-reject-in-review)
+- [Backup pins and rotation](#backup-pins-and-rotation)
+- [Where ATS meets trust](#where-ats-meets-trust)
+- [API timeline](#api-timeline)
+- [Threads and performance](#threads-and-performance)
+- [CI guardrails](#ci-guardrails)
+- [Related and sources](#related-and-sources)
+- [Checklist](#checklist)
+<!-- /toc -->
+
 What is here: the Security types for certificates, trust, identities and policies;
 pinning, whether by leaf, by issuing CA, by public-key digest or declaratively through
 `NSPinnedDomains`; building your own trust policy; mutual TLS; the points where App

package/pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md

@@ -1,5 +1,24 @@
 # Insecure Patterns in Generated iOS Code
 
+<!-- toc -->
+- [Contents](#contents)
+- [Why generated code drifts toward insecure defaults](#why-generated-code-drifts-toward-insecure-defaults)
+- [1. Secrets in UserDefaults](#1-secrets-in-userdefaults)
+- [2. Hardcoded API keys](#2-hardcoded-api-keys)
+- [3. Biometric check that only returns a Boolean](#3-biometric-check-that-only-returns-a-boolean)
+- [4. Ignoring SecItem status codes](#4-ignoring-secitem-status-codes)
+- [5. Missing or weak data protection class](#5-missing-or-weak-data-protection-class)
+- [6. Reusing an AES-GCM nonce](#6-reusing-an-aes-gcm-nonce)
+- [7. MD5 or SHA-1 where security matters](#7-md5-or-sha-1-where-security-matters)
+- [8. Secrets in logs](#8-secrets-in-logs)
+- [9. No keychain cleanup after reinstall](#9-no-keychain-cleanup-after-reinstall)
+- [10. Weak randomness for security values](#10-weak-randomness-for-security-values)
+- [Quick reference](#quick-reference)
+- [Automating detection in CI](#automating-detection-in-ci)
+- [What iOS 26 changes](#what-ios-26-changes)
+- [Checklist](#checklist)
+<!-- /toc -->
+
 This is the review backbone of the skill. It lists the ten security mistakes that code generators produce most often on Apple platforms. Every entry gives the reason it is dangerous, an insecure sample, a corrected sample, a way to detect it, and its OWASP mapping.
 
 Deeper material per entry: [credential-storage-patterns.md](credential-storage-patterns.md) (1 and 2), [biometric-authentication.md](biometric-authentication.md) (3), [keychain-fundamentals.md](keychain-fundamentals.md) (4), [keychain-access-control.md](keychain-access-control.md) (5), [cryptokit-symmetric.md](cryptokit-symmetric.md) (6 and 7), [migration-legacy-stores.md](migration-legacy-stores.md) (9), and [compliance-owasp-mapping.md](compliance-owasp-mapping.md) for the complete standards mapping.

package/pipeline/skills/shared/external/swift-security/references/compliance-owasp-mapping.md

@@ -1,5 +1,21 @@
 # OWASP Mobile Compliance for Apple Platforms
 
+<!-- toc -->
+- [Contents](#contents)
+- [2016 to 2024: what moved](#2016-to-2024-what-moved)
+- [Traceability matrix](#traceability-matrix)
+- [M1 Improper Credential Usage](#m1-improper-credential-usage)
+- [M3 Insecure Authentication/Authorization](#m3-insecure-authenticationauthorization)
+- [M9 Insecure Data Storage](#m9-insecure-data-storage)
+- [M10 Insufficient Cryptography](#m10-insufficient-cryptography)
+- [Choosing kSecAttrAccessible](#choosing-ksecattraccessible)
+- [Running an enterprise audit](#running-an-enterprise-audit)
+- [Post-quantum roadmap](#post-quantum-roadmap)
+- [Cross-reference index](#cross-reference-index)
+- [Takeaways](#takeaways)
+- [Checklist](#checklist)
+<!-- /toc -->
+
 This file connects everyday iOS security code with three OWASP documents as they stand for 2024 to 2026: the 2024 Mobile Top 10, the MASVS at version 2.1.0, and the MASTG. It concentrates on the four categories this skill owns: M1, M3, M9 and M10.
 
 Generated code and older audit templates still quote the 2016 list, for example calling data storage "M2" or cryptography "M5". The 2024 list replaced that numbering completely.

package/pipeline/skills/shared/external/swift-security/references/credential-storage-patterns.md

@@ -1,5 +1,24 @@
 # Credential Storage Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Six ways credentials leak](#six-ways-credentials-leak)
+- [Choosing the protection class](#choosing-the-protection-class)
+- [One actor in front of the Keychain](#one-actor-in-front-of-the-keychain)
+- [OAuth tokens: from sign-in to Keychain](#oauth-tokens-from-sign-in-to-keychain)
+- [Refresh that survives crashes and races](#refresh-that-survives-crashes-and-races)
+- [API keys fetched at runtime](#api-keys-fetched-at-runtime)
+- [Logout clears everything](#logout-clears-everything)
+- [Rotation and versioned storage](#rotation-and-versioned-storage)
+- [Device binding and restores](#device-binding-and-restores)
+- [Biometrics on high-value credentials](#biometrics-on-high-value-credentials)
+- [What iOS 17 and 18 changed](#what-ios-17-and-18-changed)
+- [Guardrails in CI](#guardrails-in-ci)
+- [OWASP mapping](#owasp-mapping)
+- [The three decisions that matter](#the-three-decisions-that-matter)
+- [Checklist](#checklist)
+<!-- /toc -->
+
 OAuth tokens, API keys and passwords have exactly one place Apple sanctions for
 them on the device: the Keychain. When a 2025 study pulled apart App Store
 binaries, 71% of the iOS apps it examined exposed one or more embedded secrets, most

package/pipeline/skills/shared/external/swift-security/references/cryptokit-public-key.md

@@ -1,5 +1,23 @@
 # CryptoKit: Signatures, Key Agreement, HPKE and Post-Quantum
 
+<!-- toc -->
+- [Contents](#contents)
+- [Picking a curve or algorithm](#picking-a-curve-or-algorithm)
+- [Signing and key agreement are different types](#signing-and-key-agreement-are-different-types)
+- [Key agreement always goes through a KDF](#key-agreement-always-goes-through-a-kdf)
+- [HPKE (iOS 17+)](#hpke-ios-17)
+- [Post-quantum cryptography (iOS 26+)](#post-quantum-cryptography-ios-26)
+- [PEM and DER (iOS 14+)](#pem-and-der-ios-14)
+- [The Secure Enclave, briefly](#the-secure-enclave-briefly)
+- [RSA](#rsa)
+- [Frequent mistakes](#frequent-mistakes)
+- [Availability](#availability)
+- [Performance and threads](#performance-and-threads)
+- [Sources](#sources)
+- [Summary](#summary)
+- [Checklist](#checklist)
+<!-- /toc -->
+
 Topics: digital signatures (ECDSA, EdDSA), Diffie-Hellman over elliptic curves,
 hybrid public-key encryption from iOS 17,
 ML-KEM and ML-DSA with hybrid migration (iOS 26+), key serialization, and where the

package/pipeline/skills/shared/external/swift-security/references/cryptokit-symmetric.md

@@ -1,5 +1,21 @@
 # CryptoKit: Hashing, MACs and Symmetric Encryption
 
+<!-- toc -->
+- [Contents](#contents)
+- [Digests](#digests)
+- [HMAC](#hmac)
+- [AES-GCM](#aes-gcm)
+- [ChaChaPoly](#chachapoly)
+- [SymmetricKey](#symmetrickey)
+- [Moving off CommonCrypto](#moving-off-commoncrypto)
+- [Frequent mistakes](#frequent-mistakes)
+- [Post-quantum outlook](#post-quantum-outlook)
+- [OWASP mapping](#owasp-mapping)
+- [Tests worth writing](#tests-worth-writing)
+- [Sources](#sources)
+- [Checklist](#checklist)
+<!-- /toc -->
+
 This file covers the symmetric half of CryptoKit: digests (SHA-2 and SHA-3), HMAC,
 the two AEAD ciphers (AES-GCM and ChaChaPoly), `SymmetricKey`, nonce handling, key
 derivation with HKDF and PBKDF2, and moving old CommonCrypto code over. The baseline

package/pipeline/skills/shared/external/swift-security/references/keychain-access-control.md

@@ -1,5 +1,22 @@
 # Keychain Access Control
 
+<!-- toc -->
+- [Contents](#contents)
+- [When: The Accessibility Constants](#when-the-accessibility-constants)
+- [How: SecAccessControl Flags](#how-secaccesscontrol-flags)
+- [Accessibility and Access Control Are Exclusive](#accessibility-and-access-control-are-exclusive)
+- [Choosing a Combination](#choosing-a-combination)
+- [Mistakes in Generated Code](#mistakes-in-generated-code)
+- [Code Patterns](#code-patterns)
+- [macOS: kSecUseDataProtectionKeychain](#macos-ksecusedataprotectionkeychain)
+- [File Protection Sidebar](#file-protection-sidebar)
+- [Error Codes](#error-codes)
+- [Version Timeline](#version-timeline)
+- [Testing](#testing)
+- [Checklist](#checklist)
+- [Related Files](#related-files)
+<!-- /toc -->
+
 Two independent settings decide whether a read succeeds:
 
 - **When** the item can be decrypted: `kSecAttrAccessible` picks the data

package/pipeline/skills/shared/external/swift-security/references/keychain-fundamentals.md

@@ -1,5 +1,22 @@
 # Keychain Fundamentals
 
+<!-- toc -->
+- [Contents](#contents)
+- [How the Keychain Is Built](#how-the-keychain-is-built)
+- [Dictionary Contracts](#dictionary-contracts)
+- [Uniqueness](#uniqueness)
+- [Saving: Add, Then Update on Duplicate](#saving-add-then-update-on-duplicate)
+- [Reading](#reading)
+- [One Place That Builds Queries](#one-place-that-builds-queries)
+- [OSStatus Codes](#osstatus-codes)
+- [An Actor Around the Keychain (iOS 13+ / macOS 10.15+)](#an-actor-around-the-keychain-ios-13-macos-1015)
+- [Performance](#performance)
+- [macOS: Two Keychains (TN3137)](#macos-two-keychains-tn3137)
+- [Accessibility at a Glance](#accessibility-at-a-glance)
+- [Checklist](#checklist)
+- [Related Files](#related-files)
+<!-- /toc -->
+
 Every other reference in this skill builds on the material here: how the four
 `SecItem` functions behave, what their dictionaries may contain, how to read
 their status codes, and how to keep them away from the main thread.

package/pipeline/skills/shared/external/swift-security/references/keychain-item-classes.md

@@ -1,5 +1,22 @@
 # Keychain Item Classes
 
+<!-- toc -->
+- [Contents](#contents)
+- [Primary Keys per Class](#primary-keys-per-class)
+- [Generic Password](#generic-password)
+- [Internet Password](#internet-password)
+- [Key](#key)
+- [Certificate](#certificate)
+- [Identity](#identity)
+- [Mistakes Generated Code Makes](#mistakes-generated-code-makes)
+- [Platform Differences](#platform-differences)
+- [Size and When to Use a File](#size-and-when-to-use-a-file)
+- [Tests That Prove the Class Is Right](#tests-that-prove-the-class-is-right)
+- [Moving Web Logins to Internet Passwords](#moving-web-logins-to-internet-passwords)
+- [Checklist](#checklist)
+- [Related Files](#related-files)
+<!-- /toc -->
+
 The keychain stores five kinds of item: `kSecClassGenericPassword`,
 `kSecClassInternetPassword`, `kSecClassKey`, `kSecClassCertificate` and
 `kSecClassIdentity`. Choosing the wrong one does not crash anything. It shows up

package/pipeline/skills/shared/external/swift-security/references/keychain-sharing.md

@@ -1,5 +1,23 @@
 # Keychain Sharing Across Apps and Extensions
 
+<!-- toc -->
+- [Contents](#contents)
+- [How access groups work](#how-access-groups-work)
+- [Two entitlements with two formats](#two-entitlements-with-two-formats)
+- [Code](#code)
+- [Setting up every target](#setting-up-every-target)
+- [macOS has two keychains](#macos-has-two-keychains)
+- [Moving an item to another group](#moving-an-item-to-another-group)
+- [Lifecycle surprises](#lifecycle-surprises)
+- [Platform notes](#platform-notes)
+- [Signing and distribution](#signing-and-distribution)
+- [When sharing breaks](#when-sharing-breaks)
+- [Threat model](#threat-model)
+- [2024 to 2026](#2024-to-2026)
+- [Related](#related)
+- [Checklist](#checklist)
+<!-- /toc -->
+
 Access groups are the one mechanism for letting several apps and extensions read the
 same Keychain items. Getting them right takes three things together: the exact Team ID
 prefix, an entitlement on every target that participates, and an explicit

package/pipeline/skills/shared/external/swift-security/references/migration-legacy-stores.md

@@ -1,5 +1,26 @@
 # Migrating Secrets Out of Legacy Stores
 
+<!-- toc -->
+- [Contents](#contents)
+- [Why the old stores are not acceptable](#why-the-old-stores-are-not-acceptable)
+- [Five traps to avoid](#five-traps-to-avoid)
+- [Cleaning up after a reinstall](#cleaning-up-after-a-reinstall)
+- [Atomic migration: read, write, verify, delete](#atomic-migration-read-write-verify-delete)
+- [Versioned migration with a schema number](#versioned-migration-with-a-schema-number)
+- [Orphaned items after a rename](#orphaned-items-after-a-rename)
+- [Locked devices and background launches](#locked-devices-and-background-launches)
+- [The phantom mismatch](#the-phantom-mismatch)
+- [Team ID change after an app transfer](#team-id-change-after-an-app-transfer)
+- [Cleaning up legacy artefacts](#cleaning-up-legacy-artefacts)
+- [Launch order](#launch-order)
+- [Concurrency](#concurrency)
+- [Testing migrations](#testing-migrations)
+- [Very old versions](#very-old-versions)
+- [Deleting files](#deleting-files)
+- [Key decisions](#key-decisions)
+- [Checklist](#checklist)
+<!-- /toc -->
+
 Scope: moving credentials that an older release kept in `UserDefaults`, property lists or `NSCoding` archives into the keychain, deleting the old copies safely, wiping keychain leftovers after a reinstall, running migrations by schema version, and surviving a Team ID change after an app transfer.
 
 Availability: the patterns rely on actors and on iOS 15 pre-warming behaviour, so they apply from iOS 15. Write new code against iOS 17 or later where you can.

package/pipeline/skills/shared/external/swift-security/references/secure-enclave.md

@@ -1,5 +1,21 @@
 # Secure Enclave
 
+<!-- toc -->
+- [Contents](#contents)
+- [What It Is](#what-it-is)
+- [What It Cannot Do](#what-it-cannot-do)
+- [CryptoKit SecureEnclave (iOS 13+)](#cryptokit-secureenclave-ios-13)
+- [Keeping a Key Across Launches](#keeping-a-key-across-launches)
+- [Biometric-Gated Enclave Keys](#biometric-gated-enclave-keys)
+- [Security Framework Route (iOS 10+)](#security-framework-route-ios-10)
+- [iOS 26: Post-Quantum Types in the Enclave](#ios-26-post-quantum-types-in-the-enclave)
+- [Enclave or Software Key?](#enclave-or-software-key)
+- [Six Traps](#six-traps)
+- [Testing and CI](#testing-and-ci)
+- [Operating Enclave Keys](#operating-enclave-keys)
+- [Summary](#summary)
+<!-- /toc -->
+
 The Secure Enclave is a security coprocessor kept apart from the main
 processor. It creates keys, stores them and uses them without the private
 material ever reaching the Application Processor. It has shipped since the

package/pipeline/skills/shared/external/swift-security/references/testing-security-code.md

@@ -1,5 +1,21 @@
 # Testing Security Code
 
+<!-- toc -->
+- [Contents](#contents)
+- [A protocol in front of the keychain](#a-protocol-in-front-of-the-keychain)
+- [Seven mistakes in generated keychain tests](#seven-mistakes-in-generated-keychain-tests)
+- [Simulator versus device](#simulator-versus-device)
+- [Core test patterns](#core-test-patterns)
+- [Secure Enclave tests](#secure-enclave-tests)
+- [Biometric flows](#biometric-flows)
+- [CI configuration](#ci-configuration)
+- [Test plans](#test-plans)
+- [Swift Testing](#swift-testing)
+- [Further techniques](#further-techniques)
+- [Takeaways](#takeaways)
+- [Checklist](#checklist)
+<!-- /toc -->
+
 The pattern that makes keychain code testable is a protocol between the app and the Security framework. Unit tests run against an in-memory implementation; tests that need the real keychain, the Secure Enclave or biometric hardware run on devices.
 
 The keychain does not behave the same on Simulator, on a headless CI runner and on a phone. Tests written without that in mind fail intermittently, crash on runners, or pass while proving nothing.

package/pipeline/skills/shared/external/swift-testing/references/testing-advanced.md

@@ -1,5 +1,14 @@
 # Newer Swift Testing APIs
 
+<!-- toc -->
+- [Warnings: `Issue.record(_:severity:)`](#warnings-issuerecord_severity)
+- [Cancelling a Test: `Test.cancel(_:)`](#cancelling-a-test-testcancel_)
+- [Capturing Values in Exit Tests](#capturing-values-in-exit-tests)
+- [Image Attachments](#image-attachments)
+- [Version Gates](#version-gates)
+- [Proposals](#proposals)
+<!-- /toc -->
+
 Companion to the `swift-testing` skill. Each section names the Swift Testing
 proposal (ST-nnnn) and the toolchain that ships it.
 

package/pipeline/skills/shared/external/swift-testing/references/testing-patterns.md

@@ -1,5 +1,29 @@
 # Swift Testing Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Suites](#suites)
+- [Parameterized Tests](#parameterized-tests)
+- [Execution Model](#execution-model)
+- [Confirmations](#confirmations)
+- [Known Issues Limited to Specific Failures](#known-issues-limited-to-specific-failures)
+- [Tags](#tags)
+- [Scoped Setup and Teardown with `TestScoping`](#scoped-setup-and-teardown-with-testscoping)
+- [From XCTest, Step by Step](#from-xctest-step-by-step)
+- [Test Doubles](#test-doubles)
+- [Designing for Tests](#designing-for-tests)
+- [Async and Time](#async-and-time)
+- [UI Tests Stay on XCTest](#ui-tests-stay-on-xctest)
+- [Performance Tests Stay on XCTest](#performance-tests-stay-on-xctest)
+- [Snapshot Tests](#snapshot-tests)
+- [Attachments from Files](#attachments-from-files)
+- [Exit Tests](#exit-tests)
+- [Organising Files](#organising-files)
+- [Readable Arguments](#readable-arguments)
+- [Tests That Need a Newer OS](#tests-that-need-a-newer-os)
+- [More Mistakes to Avoid](#more-mistakes-to-avoid)
+<!-- /toc -->
+
 Companion to the `swift-testing` skill.
 
 ## Contents

package/pipeline/skills/shared/external/swift-testing-pro/references/async-tests.md

@@ -1,5 +1,14 @@
 # Async tests
 
+<!-- toc -->
+- [Serializing tests](#serializing-tests)
+- [Confirming async work](#confirming-async-work)
+- [How to set a time limit for concurrent tests](#how-to-set-a-time-limit-for-concurrent-tests)
+- [How to force concurrent tests to run on a specific actor](#how-to-force-concurrent-tests-to-run-on-a-specific-actor)
+- [Testing pre-concurrency code](#testing-pre-concurrency-code)
+- [Mocking networking](#mocking-networking)
+<!-- /toc -->
+
 Swift Testing is built to be async and run tests in parallel; special care must be taken to ensure those tests run well, particularly when Swift concurrency is involved. For more help with Swift concurrency, suggest the [Swift Concurrency Pro agent skill](https://github.com/twostraws/swift-concurrency-agent-skill).