@mmerterden/multi-agent-pipeline 20.7.0 → 20.8.0

package/pipeline/skills/shared/external/app-store-review/evals/evals.json

@@ -3,41 +3,41 @@
   "evals": [
     {
       "id": 1,
-      "prompt": "Audit this iOS app's App Store submission readiness: it has subscriptions, a third-party analytics SDK, ads that may track users across apps, iPhone and iPad support, and a PrivacyInfo.xcprivacy file that only declares UserDefaults with CA92.1. Give the highest-risk rejection issues and the exact checks the team should run before upload.",
-      "expected_output": "A source-grounded App Review readiness audit covering IAP/subscription display, ATT, privacy manifests and SDK manifests, Xcode/SDK upload requirements, screenshot requirements, metadata, and reviewer access.",
+      "prompt": "Our language-learning app is universal (iPhone and iPad), sells monthly and yearly subscriptions, bundles an analytics SDK and serves personalized ads. The privacy manifest only lists CA92.1. We plan to upload in May 2026. What will block us?",
+      "expected_output": "A blocker-first readiness audit that separates upload and review blockers from cleanup and covers toolchain, ATT, SDK manifests, IAP terms and screenshot sets.",
       "files": [],
       "expectations": [
-        "Mentions that uploads after April 28, 2026 need Xcode 26 or later with the relevant platform SDK 26 or later.",
-        "Identifies that tracking across apps or websites requires ATT, NSUserTrackingUsageDescription, and no tracking before authorization.",
-        "Checks whether third-party SDK code that collects data, uses required-reason APIs, enables data collection, or contacts tracking domains has its own privacy manifest.",
-        "Warns that digital subscriptions generally require StoreKit IAP and visible subscription terms, restore purchases, and no external purchase path unless current rules or entitlements allow it.",
-        "Includes iPhone 6.9-inch and iPad 13-inch screenshot requirements for a universal iPhone/iPad app."
+        "States that uploads after April 28, 2026 must be built with Xcode 26 or later against a 26 SDK",
+        "Requires an ATT request with NSUserTrackingUsageDescription before any personalized-ad tracking, with no tracking before authorization",
+        "Says the analytics and ad SDKs need their own privacy manifests and that one CA92.1 entry does not cover them",
+        "Requires IAP for the subscriptions with price, duration, renewal and trial terms shown before purchase, a working restore, and no external purchase route",
+        "Requires a 6.9-inch iPhone screenshot set and a 13-inch iPad set"
       ]
     },
     {
       "id": 2,
-      "prompt": "Review this proposed PrivacyInfo.xcprivacy plan: the app uses UserDefaults for settings, checks free disk space before downloading offline videos, reads file modification dates for files picked through UIDocumentPickerViewController, and includes an SDK that wraps UserDefaults for the app. Which required-reason API categories and reason codes should be declared, and where should the app versus SDK declarations live?",
-      "expected_output": "A privacy-manifest reason-code review that selects current approved reason codes and correctly separates app manifest declarations from SDK manifest declarations.",
+      "prompt": "Which required-reason codes do we declare? We store user settings in UserDefaults, check free disk space before downloading lessons, show modification dates for files picked with the document picker, and a vendor SDK wraps UserDefaults for us.",
+      "expected_output": "A code-per-use mapping with the SDK declaration placed in the SDK's own manifest and a warning to re-check Apple's list.",
       "files": [],
       "expectations": [
-        "Selects NSPrivacyAccessedAPICategoryUserDefaults with CA92.1 for app-owned UserDefaults settings.",
-        "Selects NSPrivacyAccessedAPICategoryDiskSpace with E174.1 for checking free space before downloads.",
-        "Selects NSPrivacyAccessedAPICategoryFileTimestamp with 3B52.1 for user-granted document picker files.",
-        "Selects UserDefaults wrapper SDK reason C56D.1 for the SDK only and says the SDK must report its own required-reason API use in its own manifest.",
-        "Warns not to invent broad reasons and to re-check Apple's current required-reason API documentation."
+        "Maps app-only settings in UserDefaults to CA92.1",
+        "Maps the free-space check before writing downloads to E174.1",
+        "Maps timestamps of user-picked files to 3B52.1",
+        "Assigns C56D.1 to the SDK wrapper and places it in the SDK's own manifest, not the app's",
+        "Warns against invented or convenience reasons and says to re-check the current reason list before release"
       ]
     },
     {
       "id": 3,
-      "prompt": "I want better App Store keywords and screenshot captions for my habit tracker, but I also don't want a metadata rejection. Give me the compliance guardrails only, and call out which parts belong in an ASO strategy pass rather than an App Review pass.",
-      "expected_output": "A boundary-aware answer that keeps app-store-review focused on metadata compliance and routes keyword strategy and conversion optimization to the ASO skill.",
+      "prompt": "Can you review our App Store name, subtitle, keywords and screenshot captions and tell us how to rank higher?",
+      "expected_output": "Compliance guardrails only, with ranking and conversion work routed to app-store-optimization.",
       "files": [],
       "expectations": [
-        "States that keyword research, ranking strategy, and conversion optimization belong to an ASO strategy pass rather than App Review compliance.",
-        "Gives App Review metadata guardrails: accurate app name, screenshots showing real UI, no misleading features, no prices in description, no competitor names or irrelevant keywords.",
-        "Mentions the 30-character app name/subtitle limits and 100-character keyword field limit with comma-separated keywords and no spaces after commas.",
-        "Mentions current screenshot size compliance, including 6.9-inch iPhone and 13-inch iPad requirements when applicable.",
-        "Does not expand into a full keyword plan or marketing copy rewrite."
+        "Routes keyword research, ranking and conversion optimization to an ASO pass rather than doing it",
+        "Gives guardrails: an accurate name, screenshots of the real UI, no features that do not exist, no prices, no competitor or unrelated keywords",
+        "States the 30, 30 and 100 character limits and the comma-separated, no-space keyword rule",
+        "Names the 6.9-inch iPhone and 13-inch iPad screenshot sets",
+        "Does not produce a full keyword plan or rewrite the marketing copy"
       ]
     }
   ]

package/pipeline/skills/shared/external/app-store-review/references/privacy-manifest.md

@@ -1,33 +1,32 @@
-# Privacy Manifest Reference
+# Privacy Manifest (PrivacyInfo.xcprivacy)
 
-## Contents
-- When a Privacy Manifest Is Required
-- Privacy Manifest Structure
-- Required API Reason Codes
-- Privacy Manifest Keys Reference
-- Third-Party SDK Manifests
-- Collected Data Types Declaration
-- Sources To Re-Check
+## When Required
 
-## When a Privacy Manifest Is Required
+A bundle needs a privacy manifest when its code calls an API in one of the
+required-reason categories, or when it collects data or tracks. The category
+identifiers are:
 
-A `PrivacyInfo.xcprivacy` file is required if your app or any dependency uses these API categories:
+| Category | Identifier |
+|---|---|
+| File timestamps | `NSPrivacyAccessedAPICategoryFileTimestamp` |
+| System boot time | `NSPrivacyAccessedAPICategorySystemBootTime` |
+| Disk space | `NSPrivacyAccessedAPICategoryDiskSpace` |
+| User defaults | `NSPrivacyAccessedAPICategoryUserDefaults` |
+| Active keyboards | `NSPrivacyAccessedAPICategoryActiveKeyboards` |
 
-- File timestamp APIs (`NSPrivacyAccessedAPICategoryFileTimestamp`)
-- System boot time APIs (`NSPrivacyAccessedAPICategorySystemBootTime`)
-- Disk space APIs (`NSPrivacyAccessedAPICategoryDiskSpace`)
-- User defaults (`NSPrivacyAccessedAPICategoryUserDefaults`)
-- Active keyboard APIs (`NSPrivacyAccessedAPICategoryActiveKeyboards`)
+Apple adds and adjusts categories and reasons. Before each release, read the
+current reference pages for `NSPrivacyAccessedAPIType` and
+`NSPrivacyAccessedAPITypeReasons` rather than trusting a copied table.
 
-Apple updates required-reason API coverage over time. Before final submission or release, re-check the current `NSPrivacyAccessedAPIType` and `NSPrivacyAccessedAPITypeReasons` documentation and do not invent broad or convenient reasons.
+## Structure
 
-## Privacy Manifest Structure
+The file is an ordinary XML property list (Xcode adds the usual XML prolog and
+Apple plist DOCTYPE when it creates one; they are omitted below) with a
+dictionary at the root. This one belongs to
+an app that tracks nothing, collects nothing, and reads its own preferences
+from `UserDefaults`:
 
 ```xml
-<!-- PrivacyInfo.xcprivacy -->
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
-  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
     <key>NSPrivacyTracking</key>
@@ -35,9 +34,7 @@ Apple updates required-reason API coverage over time. Before final submission or
     <key>NSPrivacyTrackingDomains</key>
     <array/>
     <key>NSPrivacyCollectedDataTypes</key>
-    <array>
-        <!-- Declare every data type you collect -->
-    </array>
+    <array/>
     <key>NSPrivacyAccessedAPITypes</key>
     <array>
         <dict>
@@ -53,61 +50,102 @@ Apple updates required-reason API coverage over time. Before final submission or
 </plist>
 ```
 
+Each entry in `NSPrivacyAccessedAPITypes` pairs one category string with an
+array of reason codes.
+
 ## Required API Reason Codes
 
-Use the exact approved reason that matches the app or SDK behavior. Do not use a broad reason code because it is convenient; Apple requires the declared reason to match the presented functionality and derived-data use.
+Choose the code whose wording matches what the feature does, including what
+happens to any value derived from the API. If none fits, the use is probably not
+allowed; do not stretch a code to cover it.
 
-Before final submission, re-check Apple's current required-reason API documentation. Reason-code coverage can change, and invented or overly broad reasons are not acceptable.
+File timestamps:
 
-| API Category | Code | Reason |
-|---|---|---|
-| FileTimestamp | `DDA9.1` | Display file timestamps to the person using the device |
-| FileTimestamp | `C617.1` | Access timestamps, size, or metadata for files in the app, app group, or CloudKit container |
-| FileTimestamp | `3B52.1` | Access timestamps, size, or metadata for user-granted files or directories |
-| FileTimestamp | `0A2A.1` | Third-party SDK wrapper around file timestamp APIs, only when called by the app |
-| SystemBootTime | `35F9.1` | Measure elapsed time between events |
-| SystemBootTime | `8FFB.1` | Calculate absolute timestamps for events that occurred within the app |
-| SystemBootTime | `3D61.1` | Include system boot time in an optional user-submitted bug report |
-| DiskSpace | `85F4.1` | Display disk space information to the person using the device |
-| DiskSpace | `E174.1` | Check available or low disk space before writes or cleanup |
-| DiskSpace | `7D9E.1` | Include disk space information in an optional user-submitted bug report |
-| DiskSpace | `B728.1` | Health research app detects low disk space impacting research data collection |
-| ActiveKeyboards | `3EC4.1` | Custom keyboard app checks active keyboards |
-| ActiveKeyboards | `54BD.1` | Present UI that visibly changes based on active keyboards |
-| UserDefaults | `CA92.1` | Read/write information accessible only to the app itself |
-| UserDefaults | `1C8F.1` | Read/write information accessible only within the same App Group |
-| UserDefaults | `C56D.1` | Third-party SDK wrapper around UserDefaults APIs, only when called by the app |
-| UserDefaults | `AC6B.1` | Managed app configuration or managed feedback keys for MDM |
-
-## Privacy Manifest Keys Reference
-
-| Key | Type | Purpose |
+| Code | Allowed use |
+|---|---|
+| `DDA9.1` | Displaying a file's dates to the user of the device |
+| `C617.1` | Reading timestamps, size or other metadata of files inside the app container, an app group container or the app's CloudKit container |
+| `3B52.1` | Reading timestamps, size or metadata of files or folders the user explicitly granted access to, for example through a document picker |
+| `0A2A.1` | An SDK offering the app a thin wrapper over these APIs, invoked only by the app |
+
+System boot time:
+
+| Code | Allowed use |
+|---|---|
+| `35F9.1` | Measuring time elapsed between events in the app |
+| `8FFB.1` | Computing absolute timestamps for events that happen in the app |
+| `3D61.1` | Including boot time in a bug report the user chooses to submit |
+
+Disk space:
+
+| Code | Allowed use |
+|---|---|
+| `85F4.1` | Showing disk space figures to the user |
+| `E174.1` | Checking free or low space before writing files, or to decide when to clean up |
+| `7D9E.1` | Including disk information in a bug report the user chooses to submit |
+| `B728.1` | A health research app detecting low space that would stop research data collection |
+
+Active keyboards:
+
+| Code | Allowed use |
+|---|---|
+| `3EC4.1` | A custom keyboard app checking which keyboards are active |
+| `54BD.1` | Changing the visible UI depending on the active keyboards |
+
+User defaults:
+
+| Code | Allowed use |
+|---|---|
+| `CA92.1` | Reading and writing data that only the app itself can access |
+| `1C8F.1` | Reading and writing data shared only inside the same App Group |
+| `C56D.1` | An SDK offering the app a thin wrapper over `UserDefaults`, invoked only by the app |
+| `AC6B.1` | Reading managed app configuration or writing managed feedback keys for MDM |
+
+Worked mapping:
+
+- A settings screen persisted in the app's own defaults: `CA92.1`.
+- A download manager that checks free space before fetching: `E174.1`.
+- Showing the modified date of a file the user opened from Files: `3B52.1`.
+- A vendor library whose preferences helper the app calls: `C56D.1`, declared in
+  the library's manifest, not the app's.
+
+## Keys Reference
+
+| Key | Type | Meaning |
 |---|---|---|
-| `NSPrivacyTracking` | Boolean | Whether the app tracks users (triggers ATT requirement) |
-| `NSPrivacyTrackingDomains` | Array of strings | Domains used for tracking (connected only after ATT consent) |
-| `NSPrivacyCollectedDataTypes` | Array of dicts | Each data type collected, its purpose, and whether it is linked to identity |
-| `NSPrivacyAccessedAPITypes` | Array of dicts | Each required-reason API used and the justification codes |
+| `NSPrivacyTracking` | Boolean | The bundle tracks users as ATT defines it; `true` means the ATT prompt is required |
+| `NSPrivacyTrackingDomains` | Array of strings | Hosts the bundle contacts to track. When the user has not allowed tracking, the system blocks connections to them |
+| `NSPrivacyCollectedDataTypes` | Array of dictionaries | One entry per collected data type: purposes, identity linkage, tracking use |
+| `NSPrivacyAccessedAPITypes` | Array of dictionaries | Every required-reason API category the bundle calls, with its codes |
 
 ## Third-Party SDK Manifests
 
-- Verify each SDK, executable, or dynamic library that uses required-reason APIs includes `PrivacyInfo.xcprivacy` in the bundle containing that code
-- Ensure SDK reason codes match actual SDK usage; an SDK cannot rely on the host app's manifest to report the SDK's own required-reason API use
-- Update SDK versions when required manifests or reason declarations are missing
-- Keep the app's manifest focused on app code and app-level collected data/tracking declarations
+- A vendor framework, helper executable or dylib calling required-reason APIs
+  carries its own `PrivacyInfo.xcprivacy` inside its own bundle, with codes that
+  match what that SDK does.
+- If an SDK version lacks a manifest, or its reasons are missing, move to a
+  version that has them. Do not paste the SDK's declarations into the app's
+  manifest; the app manifest covers app code and app-level data and tracking.
 
 ## Collected Data Types Declaration
 
-Each `NSPrivacyCollectedDataTypes` entry must specify:
+Each item in `NSPrivacyCollectedDataTypes` is a dictionary with four keys:
 
-- `NSPrivacyCollectedDataType` (category)
-- `NSPrivacyCollectedDataTypeLinked` (linked to identity)
-- `NSPrivacyCollectedDataTypeTracking` (used for tracking)
-- `NSPrivacyCollectedDataTypePurposes` (purposes array)
+| Key | Content |
+|---|---|
+| `NSPrivacyCollectedDataType` | The data type identifier, for example email address or crash data |
+| `NSPrivacyCollectedDataTypeLinked` | Whether the data is tied to the user's identity |
+| `NSPrivacyCollectedDataTypeTracking` | Whether it is used for tracking |
+| `NSPrivacyCollectedDataTypePurposes` | The purposes, for example app functionality or analytics |
 
-Keep manifests, privacy nutrition labels, SDK behavior, and app functionality consistent. Mismatches cause rejection.
+If these entries disagree with the nutrition label, with what an SDK sends, or
+with the features in the app, expect a rejection.
 
 ## Sources To Re-Check
 
-- Required-reason API overview: https://sosumi.ai/documentation/bundleresources/describing-use-of-required-reason-api
-- Required-reason API categories: https://sosumi.ai/documentation/bundleresources/app-privacy-configuration/nsprivacyaccessedapitypes/nsprivacyaccessedapitype
-- Required-reason codes: https://sosumi.ai/documentation/bundleresources/app-privacy-configuration/nsprivacyaccessedapitypes/nsprivacyaccessedapitypereasons
+Start from the bundle resources documentation on developer.apple.com and open
+these pages:
+
+- the article that explains how to declare required-reason API use
+- the `NSPrivacyAccessedAPIType` key page
+- the `NSPrivacyAccessedAPITypeReasons` key page, which carries the live code list

package/pipeline/skills/shared/external/app-store-review/references/review-checklists.md

@@ -1,120 +1,133 @@
-# App Store Review Checklists
+# Review Checklists
 
-## Contents
-- App Review Information Checklist
-- Privacy Manifest Checklist
-- In-App Purchase Checklist
-- Screenshot and App Preview Checklist
-- HIG Compliance Checklist
-- Pre-Submission Checklist
+Working lists for a submission audit. Tick each line against the build that
+will actually be uploaded, not against a debug build.
 
 ## App Review Information Checklist
 
-Use this to avoid Guideline 2.1 rejections:
-
-- [ ] Demo credentials provided in App Review Information notes (if login required)
-- [ ] Demo mode available if credentials are impractical or account state is hard to reproduce
-- [ ] Demo account works and has access to all features
-- [ ] App Review notes explain login-gated, role-gated, region-gated, hardware-gated, or otherwise non-obvious features
-- [ ] All screens have real content (no placeholders or Lorem Ipsum)
-- [ ] No broken links or dead-end flows
-- [ ] All hardware-required features have fallback or reviewer instructions
+- [ ] Login required: a working username and password sit in the notes field of
+      App Review Information.
+- [ ] Credentials impractical, or the needed account state is hard to recreate:
+      the app has a demo mode and the notes say how to enter it.
+- [ ] The demo account signs in and reaches every feature, not a trimmed tier.
+- [ ] Notes explain anything gated by login, role, region or hardware, and any
+      feature a reviewer would not stumble on alone.
+- [ ] Every screen has real content. No broken links, no dead ends.
+- [ ] Features that need particular hardware have a fallback or step-by-step
+      instructions for the reviewer.
 
 ## Privacy Manifest Checklist
 
-Verify PrivacyInfo.xcprivacy completeness:
-
-- [ ] `PrivacyInfo.xcprivacy` exists where app code, SDK code, executables, or dynamic libraries need it
-- [ ] All required-reason API categories in app and bundled SDK code are declared with approved reason codes
-- [ ] `NSPrivacyTracking` is true only if tracking occurs
-- [ ] Third-party SDK manifests present and up to date when SDKs collect data, use required-reason APIs, enable data collection, or contact tracking domains
-- [ ] Privacy nutrition labels match actual data collection
-- [ ] Audit runtime network traffic and SDK transmissions; observed behavior must match privacy labels, manifests, privacy policy, and ATT state
+- [ ] A `PrivacyInfo.xcprivacy` exists in every bundle that needs one: app,
+      SDKs, executables, dynamic libraries.
+- [ ] Every required-reason category used by app code or bundled SDK code is
+      declared with an approved code that matches the use.
+- [ ] `NSPrivacyTracking` is `true` only if the app really tracks.
+- [ ] Each third-party SDK that collects data, calls required-reason APIs, turns
+      on collection or contacts tracking domains ships its own current manifest.
+- [ ] Runtime traffic and SDK transmissions were captured and compared with the
+      nutrition label, the manifests, the privacy policy and the ATT state.
 
 ## In-App Purchase Checklist
 
-- [ ] Digital goods and subscriptions use StoreKit IAP unless current storefront rules or approved entitlements allow otherwise
-- [ ] Subscription price, duration, billing frequency, auto-renewal terms, and any trial duration/post-trial price shown before purchase
-- [ ] Restore purchases button present and functional
-- [ ] No external purchase path, link, button, or call to action for digital goods unless current rules or approved entitlements allow it
-- [ ] Ask-to-buy and interrupted purchases handled
-- [ ] Transaction verification uses StoreKit 2 or server-side verification
+- [ ] Digital goods and subscriptions are sold through StoreKit unless a current rule or
+      approved entitlement allows another route.
+- [ ] Before purchase the user sees price, duration, billing frequency,
+      auto-renewal and, for trials, trial length and the price afterwards.
+- [ ] Restore Purchases is present and works.
+- [ ] No external purchase calls to action unless allowed for the storefront.
+- [ ] Purchases waiting on a parent, and purchases cut off midway, are handled.
+- [ ] Purchases are verified with StoreKit 2 or on the server.
 
 ## Screenshot and App Preview Checklist
 
-- [ ] 1-10 screenshots uploaded for each required platform and localization
-- [ ] iPhone screenshots use current App Store Connect accepted sizes; 6.9-inch iPhone screenshots are the primary set as of May 2026
-- [ ] 6.5-inch iPhone screenshots provided only when 6.9-inch iPhone screenshots are not provided or when manually optimizing that fallback
-- [ ] 13-inch iPad screenshots provided if the app runs on iPad
-- [ ] Screenshots and preview videos show actual app UI and do not misrepresent unavailable features
-- [ ] App previews are 30 seconds or shorter, with a poster frame that works without autoplay
+- [ ] 1 to 10 screenshots per platform and localization. As of May 2026 the
+      6.9-inch iPhone set is the primary one.
+- [ ] A 6.5-inch set only when there is no 6.9-inch set, or when you choose to
+      tune that fallback by hand.
+- [ ] A 13-inch iPad set for any app that supports iPad.
+- [ ] Screenshots and previews show the real UI.
+- [ ] Previews last 30 seconds or less, and the poster frame makes sense on its
+      own when autoplay is off.
 
 ## HIG Compliance Checklist
 
-### Navigation
-- [ ] `NavigationStack` used (not `NavigationView`)
-- [ ] System back chevron used; no custom back icons
-- [ ] Tab bar uses <= 5 tabs; use More tab if needed
-- [ ] Avoid hamburger menus
-
-### Modals and Sheets
-- [ ] Sheets have a visible dismiss control
-- [ ] Full-screen modals have close/done button
-- [ ] Alerts use system alert styles
-
-### System Feature Support
-- [ ] Dark Mode renders correctly
-- [ ] Dynamic Type supported throughout
-- [ ] iPad multitasking supported (Slide Over, Split View)
-- [ ] Dynamic Island / Live Activities render correctly when used
-- [ ] System gestures not disabled
-
-### Widgets and Live Activities
-- [ ] Widgets show real content (not placeholders)
-- [ ] Timelines update meaningfully
-- [ ] Live Activities show time-sensitive info
-- [ ] Lock Screen widgets are legible at small sizes
+These are design-quality items. Most will not cause a rejection alone, but
+reviewers notice them and they compound other findings.
+
+Navigation:
+
+- [ ] `NavigationStack`, not the deprecated `NavigationView`.
+- [ ] The system back chevron, not a custom back icon.
+- [ ] At most five tab bar items; overflow goes to a More tab.
+- [ ] No hamburger menu as the main navigation.
+
+Modals:
+
+- [ ] Sheets have a visible way to dismiss.
+- [ ] Full-screen modals have Close or Done.
+- [ ] Alerts use the system styles.
+
+System features:
+
+- [ ] Dark Mode renders correctly.
+- [ ] Dynamic Type scales without clipping.
+- [ ] iPad multitasking (Slide Over, Split View) works.
+- [ ] Dynamic Island and Live Activities render correctly when the app uses them.
+- [ ] System gestures are not disabled.
+
+Widgets and Live Activities:
+
+- [ ] Widgets display live data; no placeholder content ships.
+- [ ] Timelines update in a way the user can see is meaningful.
+- [ ] Live Activities carry time-sensitive information only.
+- [ ] Lock Screen widgets stay legible at small sizes.
 
 ## Pre-Submission Checklist
 
-### Completeness
-- [ ] No placeholder or test content
-- [ ] All features functional without special hardware
-- [ ] Demo credentials or demo mode provided, with App Review notes for gated or non-obvious features
-- [ ] No dead-end screens
-
-### Metadata
-- [ ] App name matches functionality
-- [ ] Screenshots are real app screenshots using current required platform sizes, including 6.9-inch iPhone and 13-inch iPad when applicable
-- [ ] Description contains no prices or competitor mentions
-- [ ] Category is correct
-
-### Privacy
-- [ ] Privacy manifest present where required, with approved reason codes
-- [ ] Third-party SDK manifests verified
-- [ ] Privacy policy URL present and accessible
-- [ ] Audit runtime network traffic and SDK transmissions; nutrition labels, privacy manifest declarations, privacy policy, and observed behavior match actual data collection
-- [ ] ATT prompt only if tracking occurs
-
-### Payments
-- [ ] Digital content uses StoreKit IAP unless current rules or approved entitlements allow otherwise
-- [ ] Subscription price, duration, billing frequency, auto-renewal terms, and any trial duration/post-trial price visible before purchase
-- [ ] No external purchase paths, payment links, buttons, or calls to action unless current storefront rules or approved entitlements allow them
-- [ ] Free trial terms clear
-- [ ] Restore purchases implemented
-
-### Design
-- [ ] Standard navigation patterns used
-- [ ] Dark Mode supported
-- [ ] Dynamic Type supported
-- [ ] No custom alerts mimicking system alerts
-- [ ] Launch screen not an ad
-- [ ] Empty states provide guidance
-
-### Technical
-- [ ] Built with Xcode 26 or later and relevant platform SDK 26 or later for uploads after April 28, 2026
-- [ ] No private API usage
-- [ ] No dynamic code execution
-- [ ] Entitlements justified with usage descriptions
-- [ ] Background modes justified and used
-- [ ] Deployment target is intentionally chosen and tested
+Completeness:
+
+- [ ] No placeholder or test content.
+- [ ] Every feature works without special hardware, or the notes explain it.
+- [ ] Demo credentials or demo mode, with notes.
+- [ ] No dead ends.
+
+Metadata:
+
+- [ ] The name matches what the app does.
+- [ ] Screenshots are real and at the current required sizes.
+- [ ] No prices or competitor names in the description.
+- [ ] The category is correct.
+
+Privacy:
+
+- [ ] Manifest present with approved reason codes.
+- [ ] SDK manifests checked.
+- [ ] Privacy policy URL set and reachable.
+- [ ] Runtime and SDK audit agrees with labels, manifest and policy.
+- [ ] ATT prompt only if the app tracks.
+
+Payments:
+
+- [ ] IAP for digital content.
+- [ ] Full subscription and trial terms visible before purchase.
+- [ ] No external payment calls to action unless allowed.
+- [ ] Free trial terms are clear.
+- [ ] Restore implemented.
+
+Design:
+
+- [ ] Standard navigation.
+- [ ] Dark Mode and Dynamic Type.
+- [ ] No custom alerts that imitate system alerts.
+- [ ] The launch screen is not an advertisement.
+- [ ] Empty states tell the user what to do next.
+
+Technical:
+
+- [ ] Uploads after April 28, 2026 built with Xcode 26+ and SDK 26+.
+- [ ] No private APIs.
+- [ ] No code downloaded and executed to change features.
+- [ ] Every entitlement justified, with usage descriptions.
+- [ ] Every background mode justified and in use.
+- [ ] Deployment target chosen on purpose and tested on the oldest supported OS.