@mmerterden/multi-agent-pipeline 20.34.0 → 20.36.0

package/pipeline/skills/shared/external/realitykit-ar/references/realitykit-patterns.md

@@ -1,5 +1,17 @@
 # RealityKit Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Physics](#physics)
+- [Animation](#animation)
+- [Materials and lighting](#materials-and-lighting)
+- [Custom components and systems](#custom-components-and-systems)
+- [Occlusion and environment](#occlusion-and-environment)
+- [A SwiftUI model viewer](#a-swiftui-model-viewer)
+- [Entity accessibility](#entity-accessibility)
+- [Performance](#performance)
+<!-- /toc -->
+
 Longer examples for the `realitykit-ar` skill. SKILL.md covers setup, anchoring,
 raycasting and gestures; this file goes deeper.
 

package/pipeline/skills/shared/external/retrofit-networking/references/patterns.md

@@ -1,5 +1,19 @@
 # Retrofit Networking -- Reference Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [API Interface](#api-interface)
+- [Retrofit Setup with Hilt](#retrofit-setup-with-hilt)
+- [OkHttp Interceptors](#okhttp-interceptors)
+- [Error Handling](#error-handling)
+- [Network-Bound Resource](#network-bound-resource)
+- [Multipart Uploads](#multipart-uploads)
+- [WebSocket Support](#websocket-support)
+- [Envelope to Typed Exception](#envelope-to-typed-exception)
+- [Unknown-Tolerant Enum Serialization](#unknown-tolerant-enum-serialization)
+- [Client Composition and Environment Config](#client-composition-and-environment-config)
+<!-- /toc -->
+
 Full code for the patterns summarized in `SKILL.md`. Load the section you need
 when implementing that part of the networking layer.
 

package/pipeline/skills/shared/external/room-database/references/patterns.md

@@ -1,5 +1,21 @@
 # Room Database Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Entity Definition](#entity-definition)
+- [DAO Interface](#dao-interface)
+- [Database Setup](#database-setup)
+- [Reactive Queries with Flow](#reactive-queries-with-flow)
+- [TypeConverters](#typeconverters)
+- [Relations](#relations)
+- [Migration Strategies](#migration-strategies)
+- [Hilt Integration](#hilt-integration)
+- [Testing with In-Memory Database](#testing-with-in-memory-database)
+- [Encrypted Database (SQLCipher)](#encrypted-database-sqlcipher)
+- [Async Database Provisioning](#async-database-provisioning)
+- [Runtime Hygiene](#runtime-hygiene)
+<!-- /toc -->
+
 Full code examples backing the guidance in `SKILL.md`. Headings mirror the
 SKILL.md sections.
 

package/pipeline/skills/shared/external/shareplay-activities/references/shareplay-patterns.md

@@ -1,5 +1,15 @@
 # SharePlay Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [A shared sticky-note board](#a-shared-sticky-note-board)
+- [A reusable manager](#a-reusable-manager)
+- [SwiftUI entry points](#swiftui-entry-points)
+- [Syncing game state, including late joiners](#syncing-game-state-including-late-joiners)
+- [Tracking who joins and leaves](#tracking-who-joins-and-leaves)
+- [Nearby participants on visionOS](#nearby-participants-on-visionos)
+<!-- /toc -->
+
 Longer examples for the `shareplay-activities` skill. SKILL.md covers setup,
 the session lifecycle and the messenger basics; this file builds on them.
 

package/pipeline/skills/shared/external/speech-recognition/references/speechanalyzer-patterns.md

@@ -1,5 +1,15 @@
 # SpeechAnalyzer patterns (iOS 26+)
 
+<!-- toc -->
+- [Picking modules](#picking-modules)
+- [Model assets](#model-assets)
+- [Transcribing a file](#transcribing-a-file)
+- [Live audio](#live-audio)
+- [Reading results](#reading-results)
+- [Ending a session](#ending-a-session)
+- [Further reading](#further-reading)
+<!-- /toc -->
+
 Companion to the `speech-recognition` skill ([../SKILL.md](../SKILL.md)).
 Every API here needs iOS 26 or later.
 

package/pipeline/skills/shared/external/spm-build-analysis/references/build-optimization-sources.md

@@ -1,5 +1,19 @@
 # Build Optimization Sources
 
+<!-- toc -->
+- [Apple: Improving the speed of incremental builds](#apple-improving-the-speed-of-incremental-builds)
+- [Apple: Improving build efficiency with good coding practices](#apple-improving-build-efficiency-with-good-coding-practices)
+- [Apple: Building your project with explicit module dependencies](#apple-building-your-project-with-explicit-module-dependencies)
+- [SwiftLee: Build performance analysis for speeding up Xcode builds](#swiftlee-build-performance-analysis-for-speeding-up-xcode-builds)
+- [Apple: Xcode Release Notes -- Compilation Caching](#apple-xcode-release-notes----compilation-caching)
+- [Apple: Demystify explicitly built modules (WWDC24)](#apple-demystify-explicitly-built-modules-wwdc24)
+- [Swift Compile-Time Best Practices](#swift-compile-time-best-practices)
+- [Bitrise: Demystifying Explicitly Built Modules for Xcode](#bitrise-demystifying-explicitly-built-modules-for-xcode)
+- [Bitrise: Xcode Compilation Cache FAQ](#bitrise-xcode-compilation-cache-faq)
+- [RocketSim Docs: Build Insights](#rocketsim-docs-build-insights)
+- [Swift Forums: Slow incremental builds because of planning swift module](#swift-forums-slow-incremental-builds-because-of-planning-swift-module)
+<!-- /toc -->
+
 This file stores the external sources that the README and skill docs should cite consistently.
 
 ## Apple: Improving the speed of incremental builds

package/pipeline/skills/shared/external/spm-build-analysis/references/spm-analysis-checks.md

@@ -1,5 +1,24 @@
 # SPM Analysis Checks
 
+<!-- toc -->
+- [Package Graph Checks](#package-graph-checks)
+- [Package Plugin Checks](#package-plugin-checks)
+- [Package Reference Verification](#package-reference-verification)
+- [Version Pin Feasibility](#version-pin-feasibility)
+- [Binary And Remote Dependency Checks](#binary-and-remote-dependency-checks)
+- [Module Variant Checks](#module-variant-checks)
+- [Layered Architecture Validation](#layered-architecture-validation)
+- [Circular Dependency Detection](#circular-dependency-detection)
+- [Module Sizing Guidance](#module-sizing-guidance)
+- [Transitive Dependency Minimization](#transitive-dependency-minimization)
+- [Interface/Implementation Separation](#interfaceimplementation-separation)
+- [Test Target Isolation](#test-target-isolation)
+- [Swift Macro Rebuild Impact](#swift-macro-rebuild-impact)
+- [Multi-Platform Build Multiplication](#multi-platform-build-multiplication)
+- [CI-Specific Checks](#ci-specific-checks)
+- [Recommendation Prioritization](#recommendation-prioritization)
+<!-- /toc -->
+
 Use this reference when package dependencies or package plugins are suspected build bottlenecks.
 
 ## Package Graph Checks

package/pipeline/skills/shared/external/storekit/references/core-patterns.md

@@ -1,5 +1,18 @@
 # StoreKit 2 Core Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Buying with PurchaseAction](#buying-with-purchaseaction)
+- [Launch-Time Transaction Listener](#launch-time-transaction-listener)
+- [Computing Entitlements](#computing-entitlements)
+- [Subscription Paywall](#subscription-paywall)
+- [Product Shelves: StoreView and ProductView](#product-shelves-storeview-and-productview)
+- [Is a Plan Active?](#is-a-plan-active)
+- [Verifying the Install with AppTransaction](#verifying-the-install-with-apptransaction)
+- [Store View Callbacks](#store-view-callbacks)
+- [Ten Mistakes, Fixed](#ten-mistakes-fixed)
+<!-- /toc -->
+
 Complete, copyable code for the core flows, followed by the ten common
 mistakes with a wrong and a right version each. Control styles, offers,
 testing, server validation and subscription edge cases are in

package/pipeline/skills/shared/external/storekit/references/storekit-advanced.md

@@ -1,5 +1,36 @@
 # StoreKit 2 Advanced Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Paywall Control Styles](#paywall-control-styles)
+- [Where the Controls Sit](#where-the-controls-sit)
+- [Button Labels](#button-labels)
+- [Container Backgrounds](#container-backgrounds)
+- [Store Buttons](#store-buttons)
+- [Policy Destinations](#policy-destinations)
+- [An Icon per Option](#an-icon-per-option)
+- [Sign-In Action](#sign-in-action)
+- [Grouping Options (iOS 18+)](#grouping-options-ios-18)
+- [Introductory Offers](#introductory-offers)
+- [Promotional Offers](#promotional-offers)
+- [Win-Back Offers (iOS 18+)](#win-back-offers-ios-18)
+- [Offer Codes](#offer-codes)
+- [Which Offer a Transaction Used](#which-offer-a-transaction-used)
+- [Server-Side Validation](#server-side-validation)
+- [Testing in Xcode](#testing-in-xcode)
+- [Renewal States and What to Grant](#renewal-states-and-what-to-grant)
+- [Grace Period and Billing Retry](#grace-period-and-billing-retry)
+- [Refunds](#refunds)
+- [Family Sharing](#family-sharing)
+- [Ask to Buy](#ask-to-buy)
+- [Task Modifiers](#task-modifiers)
+- [Live Subscription Status](#live-subscription-status)
+- [Promoted Purchases on the Product Page](#promoted-purchases-on-the-product-page)
+- [Price Increases](#price-increases)
+- [Unfinished Transactions](#unfinished-transactions)
+- [Advanced Mistakes](#advanced-mistakes)
+<!-- /toc -->
+
 Reach for this file once purchasing, the launch-time listener and entitlement
 checks from [core-patterns.md](core-patterns.md) are in place. Each heading
 names the release an API needs; the skill as a whole targets iOS 26.

package/pipeline/skills/shared/external/swift-api-design-guidelines/references/argument-labels-and-parameters.md

@@ -1,5 +1,13 @@
 # Argument Labels and Parameters
 
+<!-- toc -->
+- [Prepositional labels](#prepositional-labels)
+- [Grammatical phrases](#grammatical-phrases)
+- [Conversions](#conversions)
+- [Parameter names are documentation](#parameter-names-are-documentation)
+- [Default arguments instead of method families](#default-arguments-instead-of-method-families)
+<!-- /toc -->
+
 Harder cases for the label rules in the main skill, plus how to name
 parameters and order defaulted ones.
 

package/pipeline/skills/shared/external/swift-api-design-guidelines/references/conventions-and-special-rules.md

@@ -1,5 +1,14 @@
 # Conventions and Special Rules
 
+<!-- toc -->
+- [Casing](#casing)
+- [Complexity notes](#complexity-notes)
+- [Free functions](#free-functions)
+- [Overloads](#overloads)
+- [Tuples and closures](#tuples-and-closures)
+- [Unconstrained polymorphism](#unconstrained-polymorphism)
+<!-- /toc -->
+
 Casing, complexity notes, when a free function is right, safe overloading,
 labelled tuples and closures, and the traps of unconstrained polymorphism.
 

package/pipeline/skills/shared/external/swift-api-design-guidelines/references/naming-and-clarity.md

@@ -1,5 +1,15 @@
 # Naming and Clarity
 
+<!-- toc -->
+- [Words that must stay](#words-that-must-stay)
+- [Words that can go](#words-that-can-go)
+- [Roles, not types](#roles-not-types)
+- [Generic parameters](#generic-parameters)
+- [Weak types need help](#weak-types-need-help)
+- [Method or property](#method-or-property)
+- [Choosing terms](#choosing-terms)
+<!-- /toc -->
+
 How to decide which words a name needs, which it can lose, and how to choose
 between a method and a property.
 

package/pipeline/skills/shared/external/swift-api-design-guidelines/references/side-effects-and-mutating-pairs.md

@@ -1,5 +1,13 @@
 # Side Effects and Mutating Pairs
 
+<!-- toc -->
+- [Examples by kind](#examples-by-kind)
+- [Choosing between -ed and -ing](#choosing-between--ed-and--ing)
+- [The form prefix](#the-form-prefix)
+- [Booleans](#booleans)
+- [make factories](#make-factories)
+<!-- /toc -->
+
 Naming that tells the caller, at a glance, whether an operation changes the
 receiver.
 

package/pipeline/skills/shared/external/swift-charts/references/charts-patterns.md

@@ -1,5 +1,29 @@
 # Swift Charts Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Modelling the Data](#modelling-the-data)
+- [Bars](#bars)
+- [Lines](#lines)
+- [Pies and Donuts](#pies-and-donuts)
+- [Combining Marks](#combining-marks)
+- [A Tooltip on Selection](#a-tooltip-on-selection)
+- [Scrolling with a Bound Position](#scrolling-with-a-bound-position)
+- [Function Plots (iOS 18)](#function-plots-ios-18)
+- [3D Charts and Surfaces (iOS 26)](#3d-charts-and-surfaces-ios-26)
+- [Accessibility](#accessibility)
+- [Dynamic Type and Colour](#dynamic-type-and-colour)
+- [Performance: When to Vectorize](#performance-when-to-vectorize)
+- [Dark Mode and Theming](#dark-mode-and-theming)
+- [Heat Map](#heat-map)
+- [Stacking](#stacking)
+- [`MarkDimension`](#markdimension)
+- [Symbols](#symbols)
+- [`ChartProxy` and Coordinates](#chartproxy-and-coordinates)
+- [Modifier Quick Reference](#modifier-quick-reference)
+- [Apple Documentation](#apple-documentation)
+<!-- /toc -->
+
 Companion to the `swift-charts` skill. Any source file touching these types
 imports `Charts` next to `SwiftUI`.
 

package/pipeline/skills/shared/external/swift-concurrency/references/bridging-interop.md

@@ -1,5 +1,13 @@
 # Bridging Callbacks, Delegates and GCD
 
+<!-- toc -->
+- [Checked continuations](#checked-continuations)
+- [Bridging a delegate](#bridging-a-delegate)
+- [Passing cancellation through](#passing-cancellation-through)
+- [Streams from repeating callbacks](#streams-from-repeating-callbacks)
+- [Replacing GCD](#replacing-gcd)
+<!-- /toc -->
+
 ## Checked continuations
 
 `withCheckedContinuation` (non-throwing) and `withCheckedThrowingContinuation`

package/pipeline/skills/shared/external/swift-concurrency/references/concurrency-patterns.md

@@ -1,5 +1,19 @@
 # Approachable Concurrency Patterns
 
+<!-- toc -->
+- [What problem 6.2 fixed](#what-problem-62-fixed)
+- [Default MainActor isolation (SE-0466)](#default-mainactor-isolation-se-0466)
+- [Async functions run on the caller (SE-0461)](#async-functions-run-on-the-caller-se-0461)
+- [Leaving the caller with `@concurrent`](#leaving-the-caller-with-concurrent)
+- [Starting without a queue hop (SE-0472)](#starting-without-a-queue-hop-se-0472)
+- [Isolated conformances](#isolated-conformances)
+- [Immutable weak references (SE-0481)](#immutable-weak-references-se-0481)
+- [Transactional observation (SE-0475)](#transactional-observation-se-0475)
+- [Global and static state](#global-and-static-state)
+- [Build settings and migration](#build-settings-and-migration)
+- [The progression](#the-progression)
+<!-- /toc -->
+
 Swift 6.2 lets a target start out effectively single-threaded: with both
 Default Actor Isolation set to `MainActor` and Approachable Concurrency turned
 on, code runs on the main actor until you introduce parallelism deliberately.

package/pipeline/skills/shared/external/swift-concurrency/references/swiftui-concurrency.md

@@ -1,5 +1,17 @@
 # SwiftUI and Concurrency
 
+<!-- toc -->
+- [Views live on the main actor](#views-live-on-the-main-actor)
+- [Callbacks SwiftUI may run off the main thread](#callbacks-swiftui-may-run-off-the-main-thread)
+- [Reading state inside a Sendable closure](#reading-state-inside-a-sendable-closure)
+- [Structuring async work](#structuring-async-work)
+- [The `.task` modifier](#the-task-modifier)
+- [Observable view models](#observable-view-models)
+- [Reacting to model changes with Observations](#reacting-to-model-changes-with-observations)
+- [Concurrency for performance](#concurrency-for-performance)
+- [Mistakes](#mistakes)
+<!-- /toc -->
+
 ## Views live on the main actor
 
 The `View` protocol is isolated to `@MainActor` (from the iOS 18 SDK on; older

package/pipeline/skills/shared/external/swift-concurrency/references/synchronization-primitives.md

@@ -1,5 +1,15 @@
 # Synchronization Primitives
 
+<!-- toc -->
+- [Mutex](#mutex)
+- [OSAllocatedUnfairLock](#osallocatedunfairlock)
+- [Mutex or OSAllocatedUnfairLock](#mutex-or-osallocatedunfairlock)
+- [Atomic](#atomic)
+- [Locks or actors](#locks-or-actors)
+- [Decision guide](#decision-guide)
+- [Anti-patterns](#anti-patterns)
+<!-- /toc -->
+
 When an actor is the wrong shape for some shared mutable state, these types
 protect it instead. Each one is `Sendable` and safe to use from any thread.
 

package/pipeline/skills/shared/external/swift-concurrency-expert/references/swift-6-2-concurrency.md

@@ -1,5 +1,13 @@
 ## Concurrent programming updates in Swift 6.2
 
+<!-- toc -->
+- [Concurrent programming updates in Swift 6.2](#concurrent-programming-updates-in-swift-62)
+- [Data-race safety](#data-race-safety)
+- [Global State](#global-state)
+- [Offloading work to the background](#offloading-work-to-the-background)
+- [Summary](#summary)
+<!-- /toc -->
+
 Concurrent programming is hard because sharing memory between multiple tasks is prone to mistakes that lead to unpredictable behavior.
 
 ## Data-race safety

package/pipeline/skills/shared/external/swift-concurrency-pro/references/actors.md

@@ -1,5 +1,15 @@
 # Actors
 
+<!-- toc -->
+- [Reentrancy](#reentrancy)
+- [Protecting global and static state](#protecting-global-and-static-state)
+- [Global actor inference rules](#global-actor-inference-rules)
+- [`isolated` parameters](#isolated-parameters)
+- [`isolated deinit`](#isolated-deinit)
+- [What a custom actor changes](#what-a-custom-actor-changes)
+- [Making assertions](#making-assertions)
+<!-- /toc -->
+
 ## Reentrancy
 
 **Important:** This is the most common concurrency bug LLMs produce: after every `await` inside an actor, all assumptions about the actor's state are invalidated because other calls may have run in the meantime.

package/pipeline/skills/shared/external/swift-concurrency-pro/references/cancellation.md

@@ -1,5 +1,12 @@
 # Cancellation
 
+<!-- toc -->
+- [How cancellation propagates](#how-cancellation-propagates)
+- [Checking for cancellation](#checking-for-cancellation)
+- [`withTaskCancellationHandler`](#withtaskcancellationhandler)
+- [Broken cancellation patterns](#broken-cancellation-patterns)
+<!-- /toc -->
+
 Cancellation in Swift concurrency is cooperative. Setting the cancelled flag does nothing unless the running code checks it.
 
 ## How cancellation propagates

package/pipeline/skills/shared/external/swift-concurrency-pro/references/interop.md

@@ -1,5 +1,15 @@
 # Interop and migration
 
+<!-- toc -->
+- [Completion handlers → `async`/`await`](#completion-handlers-asyncawait)
+- [Delegates → `AsyncStream`](#delegates-asyncstream)
+- [`DispatchQueue.main.async` → `@MainActor`](#dispatchqueuemainasync-mainactor)
+- [`DispatchQueue.global().async` → `@concurrent` or Task Group](#dispatchqueueglobalasync-concurrent-or-task-group)
+- [Serial `DispatchQueue` → `actor`](#serial-dispatchqueue-actor)
+- [Locks and checked sendability](#locks-and-checked-sendability)
+- [Moving from Combine to `AsyncSequence`](#moving-from-combine-to-asyncsequence)
+<!-- /toc -->
+
 Approved patterns for migrating legacy concurrency mechanisms to Swift concurrency.
 
 ## Completion handlers → `async`/`await`

package/pipeline/skills/shared/external/swift-concurrency-pro/references/new-features.md

@@ -1,5 +1,16 @@
 # Swift 6.2 concurrency
 
+<!-- toc -->
+- [Control default actor isolation inference](#control-default-actor-isolation-inference)
+- [Global-actor isolated conformances](#global-actor-isolated-conformances)
+- [Run `nonisolated` async functions on the caller's actor by default](#run-nonisolated-async-functions-on-the-callers-actor-by-default)
+- [Offloading work with `@concurrent`](#offloading-work-with-concurrent)
+- [Starting tasks synchronously from caller context](#starting-tasks-synchronously-from-caller-context)
+- [Isolated deinit](#isolated-deinit)
+- [Task priority escalation APIs](#task-priority-escalation-apis)
+- [Task naming](#task-naming)
+<!-- /toc -->
+
 Use this file for recent concurrency changes that materially affect review advice.
 
 ## Control default actor isolation inference

package/pipeline/skills/shared/external/swift-concurrency-pro/references/structured.md

@@ -1,5 +1,14 @@
 # Structured concurrency
 
+<!-- toc -->
+- [`async let` vs task groups](#async-let-vs-task-groups)
+- [Task groups over loops](#task-groups-over-loops)
+- [`withDiscardingTaskGroup` (Swift 5.9+)](#withdiscardingtaskgroup-swift-59)
+- [Limiting concurrency](#limiting-concurrency)
+- [Error handling with partial results](#error-handling-with-partial-results)
+- [Inferring the type of task groups](#inferring-the-type-of-task-groups)
+<!-- /toc -->
+
 ## `async let` vs task groups
 
 Use `async let` when you have a fixed number of independent operations that return different types, e.g. fetching the news, the weather, and an app update at the same time. Use task groups when you have a dynamic number of operations of the same type, e.g. downloading all images in an array of URLs.

package/pipeline/skills/shared/external/swift-concurrency-pro/references/testing.md

@@ -1,5 +1,18 @@
 # Testing concurrent code
 
+<!-- toc -->
+- [Async tests with Swift Testing](#async-tests-with-swift-testing)
+- [Testing actor state](#testing-actor-state)
+- [The `.serialized` trait and concurrent tests](#the-serialized-trait-and-concurrent-tests)
+- [Confirmation for async events](#confirmation-for-async-events)
+- [Actor isolation in tests](#actor-isolation-in-tests)
+- [Test scoping traits with `@TaskLocal`](#test-scoping-traits-with-tasklocal)
+- [Avoid timing-based tests](#avoid-timing-based-tests)
+- [Testing cancellation](#testing-cancellation)
+- [Race detection](#race-detection)
+- [Swift Testing + Swift concurrency](#swift-testing-swift-concurrency)
+<!-- /toc -->
+
 ## Async tests with Swift Testing
 
 Swift Testing supports async test functions natively. No special setup required:

package/pipeline/skills/shared/external/swift-language/references/swift-attributes-interop.md

@@ -1,5 +1,12 @@
 # Swift 6.3 attributes for interop, performance and layout
 
+<!-- toc -->
+- [@c](#c)
+- [Module selectors](#module-selectors)
+- [Performance annotations](#performance-annotations)
+- [Symbol visibility and layout](#symbol-visibility-and-layout)
+<!-- /toc -->
+
 Attributes that became official in Swift 6.3. Each section names the Swift
 Evolution proposal so the exact rules can be checked there.
 

package/pipeline/skills/shared/external/swift-language/references/swift-patterns-extended.md

@@ -1,5 +1,19 @@
 # Extended Swift patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Codable](#codable)
+- [Result builders](#result-builders)
+- [Property wrappers](#property-wrappers)
+- [Advanced Regex](#advanced-regex)
+- [Custom FormatStyle](#custom-formatstyle)
+- [Collection patterns](#collection-patterns)
+- [guard: complex pattern matching](#guard-complex-pattern-matching)
+- [Typed throws in protocols](#typed-throws-in-protocols)
+- [String interpolation](#string-interpolation)
+- [Never: advanced usage](#never-advanced-usage)
+<!-- /toc -->
+
 Longer examples behind the main skill. Deep Codable work still belongs to
 `swift-codable`, and format styles beyond a custom style to `swift-formatstyle`.
 

package/pipeline/skills/shared/external/swift-security/references/biometric-authentication.md

@@ -1,5 +1,21 @@
 # Biometric Authentication
 
+<!-- toc -->
+- [Contents](#contents)
+- [Why a Boolean Gate Fails](#why-a-boolean-gate-fails)
+- [The Secure Pattern: Let the Keychain Ask](#the-secure-pattern-let-the-keychain-ask)
+- [evaluatePolicy and evaluateAccessControl](#evaluatepolicy-and-evaluateaccesscontrol)
+- [Which Flag](#which-flag)
+- [Availability and Degradation](#availability-and-degradation)
+- [Detecting Enrollment Changes](#detecting-enrollment-changes)
+- [Threads and async/await](#threads-and-asyncawait)
+- [Secure Enclave Keys Behind Biometrics](#secure-enclave-keys-behind-biometrics)
+- [Controls in the Development Process](#controls-in-the-development-process)
+- [Verifying at Runtime](#verifying-at-runtime)
+- [Checklist](#checklist)
+- [Sources and Related Files](#sources-and-related-files)
+<!-- /toc -->
+
 Severity when violated: **CRITICAL.** Of all the insecure patterns that code
 generators produce, a lone `LAContext.evaluatePolicy()` call guarding sensitive
 content is the most dangerous, because it can be defeated at runtime without

package/pipeline/skills/shared/external/swift-security/references/certificate-trust.md

@@ -1,5 +1,22 @@
 # Certificate Trust, Pinning and Client Certificates
 
+<!-- toc -->
+- [Contents](#contents)
+- [The four types](#the-four-types)
+- [Evaluating trust](#evaluating-trust)
+- [Custom policies and anchors](#custom-policies-and-anchors)
+- [Four ways to pin](#four-ways-to-pin)
+- [Certificates and identities](#certificates-and-identities)
+- [Mistakes to reject in review](#mistakes-to-reject-in-review)
+- [Backup pins and rotation](#backup-pins-and-rotation)
+- [Where ATS meets trust](#where-ats-meets-trust)
+- [API timeline](#api-timeline)
+- [Threads and performance](#threads-and-performance)
+- [CI guardrails](#ci-guardrails)
+- [Related and sources](#related-and-sources)
+- [Checklist](#checklist)
+<!-- /toc -->
+
 What is here: the Security types for certificates, trust, identities and policies;
 pinning, whether by leaf, by issuing CA, by public-key digest or declaratively through
 `NSPinnedDomains`; building your own trust policy; mutual TLS; the points where App

package/pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md

@@ -1,5 +1,24 @@
 # Insecure Patterns in Generated iOS Code
 
+<!-- toc -->
+- [Contents](#contents)
+- [Why generated code drifts toward insecure defaults](#why-generated-code-drifts-toward-insecure-defaults)
+- [1. Secrets in UserDefaults](#1-secrets-in-userdefaults)
+- [2. Hardcoded API keys](#2-hardcoded-api-keys)
+- [3. Biometric check that only returns a Boolean](#3-biometric-check-that-only-returns-a-boolean)
+- [4. Ignoring SecItem status codes](#4-ignoring-secitem-status-codes)
+- [5. Missing or weak data protection class](#5-missing-or-weak-data-protection-class)
+- [6. Reusing an AES-GCM nonce](#6-reusing-an-aes-gcm-nonce)
+- [7. MD5 or SHA-1 where security matters](#7-md5-or-sha-1-where-security-matters)
+- [8. Secrets in logs](#8-secrets-in-logs)
+- [9. No keychain cleanup after reinstall](#9-no-keychain-cleanup-after-reinstall)
+- [10. Weak randomness for security values](#10-weak-randomness-for-security-values)
+- [Quick reference](#quick-reference)
+- [Automating detection in CI](#automating-detection-in-ci)
+- [What iOS 26 changes](#what-ios-26-changes)
+- [Checklist](#checklist)
+<!-- /toc -->
+
 This is the review backbone of the skill. It lists the ten security mistakes that code generators produce most often on Apple platforms. Every entry gives the reason it is dangerous, an insecure sample, a corrected sample, a way to detect it, and its OWASP mapping.
 
 Deeper material per entry: [credential-storage-patterns.md](credential-storage-patterns.md) (1 and 2), [biometric-authentication.md](biometric-authentication.md) (3), [keychain-fundamentals.md](keychain-fundamentals.md) (4), [keychain-access-control.md](keychain-access-control.md) (5), [cryptokit-symmetric.md](cryptokit-symmetric.md) (6 and 7), [migration-legacy-stores.md](migration-legacy-stores.md) (9), and [compliance-owasp-mapping.md](compliance-owasp-mapping.md) for the complete standards mapping.

package/pipeline/skills/shared/external/swift-security/references/compliance-owasp-mapping.md

@@ -1,5 +1,21 @@
 # OWASP Mobile Compliance for Apple Platforms
 
+<!-- toc -->
+- [Contents](#contents)
+- [2016 to 2024: what moved](#2016-to-2024-what-moved)
+- [Traceability matrix](#traceability-matrix)
+- [M1 Improper Credential Usage](#m1-improper-credential-usage)
+- [M3 Insecure Authentication/Authorization](#m3-insecure-authenticationauthorization)
+- [M9 Insecure Data Storage](#m9-insecure-data-storage)
+- [M10 Insufficient Cryptography](#m10-insufficient-cryptography)
+- [Choosing kSecAttrAccessible](#choosing-ksecattraccessible)
+- [Running an enterprise audit](#running-an-enterprise-audit)
+- [Post-quantum roadmap](#post-quantum-roadmap)
+- [Cross-reference index](#cross-reference-index)
+- [Takeaways](#takeaways)
+- [Checklist](#checklist)
+<!-- /toc -->
+
 This file connects everyday iOS security code with three OWASP documents as they stand for 2024 to 2026: the 2024 Mobile Top 10, the MASVS at version 2.1.0, and the MASTG. It concentrates on the four categories this skill owns: M1, M3, M9 and M10.
 
 Generated code and older audit templates still quote the 2016 list, for example calling data storage "M2" or cryptography "M5". The 2024 list replaced that numbering completely.

package/pipeline/skills/shared/external/swift-security/references/credential-storage-patterns.md

@@ -1,5 +1,24 @@
 # Credential Storage Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Six ways credentials leak](#six-ways-credentials-leak)
+- [Choosing the protection class](#choosing-the-protection-class)
+- [One actor in front of the Keychain](#one-actor-in-front-of-the-keychain)
+- [OAuth tokens: from sign-in to Keychain](#oauth-tokens-from-sign-in-to-keychain)
+- [Refresh that survives crashes and races](#refresh-that-survives-crashes-and-races)
+- [API keys fetched at runtime](#api-keys-fetched-at-runtime)
+- [Logout clears everything](#logout-clears-everything)
+- [Rotation and versioned storage](#rotation-and-versioned-storage)
+- [Device binding and restores](#device-binding-and-restores)
+- [Biometrics on high-value credentials](#biometrics-on-high-value-credentials)
+- [What iOS 17 and 18 changed](#what-ios-17-and-18-changed)
+- [Guardrails in CI](#guardrails-in-ci)
+- [OWASP mapping](#owasp-mapping)
+- [The three decisions that matter](#the-three-decisions-that-matter)
+- [Checklist](#checklist)
+<!-- /toc -->
+
 OAuth tokens, API keys and passwords have exactly one place Apple sanctions for
 them on the device: the Keychain. When a 2025 study pulled apart App Store
 binaries, 71% of the iOS apps it examined exposed one or more embedded secrets, most