@mmerterden/multi-agent-pipeline 20.8.0 → 20.8.1

package/pipeline/skills/shared/external/localization-reuse-map/scripts/verify-map.py

@@ -11,42 +11,10 @@ import os
 import re
 import sys
 
-EXTENSIONS = {".swift", ".kt", ".kts", ".xml", ".ts", ".tsx", ".js", ".jsx", ".vue"}
-SKIP_PARTS = ("/.git", "/Generated/")
-
-WORD = "A-Za-z0-9_"
-LSK = re.compile(rf"LocalizationStringKey((?:\.[A-Za-z_][{WORD}]*)+)")
-LITERAL_LOCALIZED = re.compile(rf"\"([{WORD}.]+)\"\.localized\b")
-WEB_T = re.compile(r"(?<![\w$])t\(\s*(['\"])([A-Za-z0-9_.\-]+)\1")
-WEB_DOLLAR_T = re.compile(r"\$t\(\s*(['\"])([A-Za-z0-9_.\-]+)\1")
-TRAILING_MARKER = re.compile(r"\s*\([^()]*\)\s*$")
-COMPONENT_MARKER = re.compile(r"\([^)]*(owned by|bile\u015fen|component)[^)]*\)", re.IGNORECASE)
-PLACEHOLDER = re.compile(r"<[^<>]+>")
-
-
-def strip_accessor(chain):
-    segments = chain.strip(".").split(".")
-    while segments and segments[-1].startswith("localized"):
-        segments.pop()
-    return ".".join(segments)
-
-
-def normalize_key(key):
-    return ".".join(seg[:1].upper() + seg[1:] for seg in key.split("."))
-
-
-def source_files(root):
-    if os.path.isfile(root):
-        yield root
-        return
-    for current, dirs, files in os.walk(root):
-        probe = current.replace(os.sep, "/") + "/"
-        if any(part in probe for part in SKIP_PARTS):
-            dirs[:] = []
-            continue
-        for name in sorted(files):
-            if os.path.splitext(name)[1] in EXTENSIONS:
-                yield os.path.join(current, name)
+from _shared import (
+    LITERAL_KEY, WEB_DOLLAR_T, WEB_T, clean_key, is_component, is_dynamic, lsk_keys, normalize_key, raw_key,
+    source_files,
+)
 
 
 def scan_code(root):
@@ -61,28 +29,14 @@ def scan_code(root):
             continue
         scanned += 1
         corpus.append(text.lower())
-        chains = (strip_accessor(hit.group(1)) for hit in LSK.finditer(text))
-        keys.update(chain.lower() for chain in chains if chain)
-        for pattern, group in ((LITERAL_LOCALIZED, 1), (WEB_T, 2), (WEB_DOLLAR_T, 2)):
+        keys.update(key.lower() for key in lsk_keys(text))
+        for pattern, group in ((LITERAL_KEY, 1), (WEB_T, 2), (WEB_DOLLAR_T, 2)):
             keys.update(hit.group(group).lower() for hit in pattern.finditer(text))
     return keys, "\n".join(corpus), scanned
 
 
-def is_component(row):
-    text = " ".join(str(row.get(f) or "") for f in ("newKey", "element", "note"))
-    return bool(COMPONENT_MARKER.search(text))
-
-
-def is_dynamic(row, key):
-    element = str(row.get("element") or "").lower()
-    note = str(row.get("note") or "").lower()
-    return (
-        key.startswith("(dynamic")
-        or bool(PLACEHOLDER.search(key))
-        or "dinamik" in element
-        or "dynamic" in element
-        or "enumerate at runtime" in note
-    )
+def filled(value):
+    return bool(str(value or "").strip())
 
 
 def suggested_exists(root, key):
@@ -114,8 +68,7 @@ def main():
     map_keys = set()
 
     for row in rows:
-        raw_key = str(row.get("newKey") or "").strip()
-        key = raw_key if raw_key.startswith("(dynamic") else TRAILING_MARKER.sub("", raw_key)
+        key = clean_key(raw_key(row))
         component = is_component(row)
         dynamic = is_dynamic(row, key)
         if key:
@@ -136,11 +89,11 @@ def main():
         verdict = row.get("verdict")
         new = row.get("new") or {}
         legacy = row.get("legacy") or {}
-        if verdict != "new" and not new.get("tr") and not dynamic:
+        if verdict != "new" and not filled(new.get("tr")) and not dynamic:
             gaps.append({"key": key, "issue": "new.tr empty"})
-        if verdict in ("reuse", "review") and not (legacy.get("en") or legacy.get("tr")):
+        if verdict in ("reuse", "review") and not (filled(legacy.get("en")) or filled(legacy.get("tr"))):
             gaps.append({"key": key, "issue": f"verdict={verdict} but no legacy value"})
-        if new.get("tr") and new.get("tr") == new.get("en"):
+        if filled(new.get("tr")) and new.get("tr") == new.get("en"):
             untranslated.append(key)
         if args.resources_root and not component and not dynamic and key and not suggested_exists(args.resources_root, key):
             gaps.append({"key": key, "issue": f"no Suggested/{normalize_key(key)}.json"})

package/pipeline/skills/shared/external/mapkit-location/SKILL.md

@@ -309,9 +309,11 @@ func lookUp(_ text: String) async throws -> MKMapItem? {
 Reverse lookup is `MKReverseGeocodingRequest(location:)`. Formatting and
 batch lookups are in [Geocoding and Places on iOS 26](references/mapkit-patterns.md#geocoding-and-places-on-ios-26).
 
-### CLGeocoder (iOS 5 to iOS 25, deprecated in iOS 26)
+### CLGeocoder (available since iOS 5, deprecated in iOS 26)
 
-Use it only while the deployment target is below iOS 26. Every `CLPlacemark`
+Use it only while the deployment target is below iOS 26. The SDK's deprecation
+messages point reverse lookups to `MKReverseGeocodingRequest` and forward
+lookups to `MKGeocodingRequest`. Every `CLPlacemark`
 field is optional. `CLGeocoder` is not `Sendable`, so Swift 6 rejects one
 shared global instance; make a geocoder for each lookup instead.
 

package/pipeline/skills/shared/external/skill-creator/template.md

@@ -1,6 +1,6 @@
 # Skill templates
 
-Two skeletons. Copy the one that matches the layer, fill it, then delete every line that fails the cut test. The toolkits use these frontmatter keys: `name`, `description`, `allowed-tools`, `user-invocable`, plus an optional `argument-hint`.
+Two skeletons. Copy the one that matches the layer, fill it, then delete every line that fails the cut test. The toolkits use these frontmatter keys: `name`, `description`, `allowed-tools`, `user-invocable`, plus an optional `argument-hint` and an optional `metadata` block with `version` (semver of the skill text) and `source` (`multi-agent-pipeline` for a first-party skill, otherwise the upstream it derives from, which a `NOTICE-*.md` beside it must list). Drop the block rather than leave a placeholder in it.
 
 ## Reference skill
 
@@ -10,6 +10,9 @@ name: {aspect-noun}
 description: "{What it covers} for {platform}. {When to reach for it}. Triggers: '{phrase}', '{phrase}', '{phrase}'."
 user-invocable: true
 allowed-tools: Bash, Read, Edit, Write, Glob, Grep
+metadata:
+  version: {x.y.z}
+  source: {multi-agent-pipeline | upstream}
 ---
 
 # {name} - {short title}
@@ -44,6 +47,9 @@ description: "{What it does} for {platform}, with {guardrails}. Use when {situat
 user-invocable: true
 argument-hint: "{args}"
 allowed-tools: Bash, Read
+metadata:
+  version: {x.y.z}
+  source: {multi-agent-pipeline | upstream}
 ---
 
 # {name} - {short title}

package/pipeline/skills/shared/external/storekit/references/core-patterns.md

@@ -99,7 +99,7 @@ struct RecipesApp: App {
     }
 
     private static func watchTransactions() -> Task<Void, Never> {
-        Task.detached(priority: .background) {
+        Task(priority: .background) {
             for await incoming in StoreKit.Transaction.updates {
                 if case .verified(let receipt) = incoming {
                     await EntitlementStore.shared.refresh()
@@ -114,6 +114,11 @@ struct RecipesApp: App {
 Unverified updates fall through untouched. For each verified one,
 entitlements are recomputed first and the transaction finished afterwards.
 
+A plain `Task` is enough here. It inherits the main actor from the `App`, but
+the loop spends its time suspended in `for await` and the entitlement refresh
+runs on the main-actor `EntitlementStore` anyway; `Task.detached` would only add
+a hop and drop the task-local values.
+
 ## Computing Entitlements
 
 ```swift

package/pipeline/skills/shared/external/swift-concurrency/SKILL.md

@@ -7,10 +7,11 @@ metadata:
 
 # Swift Concurrency
 
-Baseline: Swift 6.3 compilers and later. The aim of every change made with this
+Baseline: Swift 6.2 compilers and later. The aim of every change made with this
 skill is data-race safety through isolation and `Sendable`, reached with the
 smallest possible change in behavior. Features newer than Swift 6.0 name the
-release or proposal that introduced them.
+release or proposal that introduced them; the few that need Swift 6.3, such as
+`weak let` (SE-0481), are marked as 6.3 only.
 
 Not for the smallest fix to a single diagnostic (use `swift-concurrency-expert`)
 or a file-by-file review pass (use `swift-concurrency-pro`).

package/pipeline/skills/shared/external/swift-concurrency/references/concurrency-patterns.md

@@ -157,7 +157,7 @@ nonisolated struct OffMainBackupBatch {
 
 `weak let` declares a weak reference that is never reassigned. Because the
 binding cannot change, a type storing only `weak let` references to `Sendable`
-objects can itself be `Sendable`. Implemented in Swift 6.3.
+objects can itself be `Sendable`. Swift 6.3 only.
 
 ```swift
 final class SessionObserver: Sendable {

package/pipeline/skills/shared/external/swift-security/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: swift-security
-description: "Apple client security: Keychain (SecItem, kSecClass, OSStatus, iOS and macOS), Face ID/Touch ID (LAContext), CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, OAuth token and API key storage, SecTrust/SPKI pinning, keychain sharing, moving secrets out of UserDefaults or plists, OWASP MASVS/MASTG. Use when writing, reviewing or migrating code that stores secrets, holds keys or evaluates trust. Not for passkeys, App Attest or App Review."
+description: "Apple client security: Keychain (SecItem, kSecClass, OSStatus, iOS, macOS), Face ID/Touch ID keychain items, CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, OAuth token and API key storage, SecTrust/SPKI pinning, keychain sharing, moving secrets out of UserDefaults or plists, OWASP MASVS/MASTG. Use when writing, reviewing or migrating code that stores secrets, holds keys or evaluates trust. Not for passkeys, App Attest or App Review."
 metadata:
   source: multi-agent-pipeline
 ---
@@ -81,9 +81,9 @@ and should be worded that way.
    `errSecDuplicateItem`, call `SecItemUpdate`. Deleting and re-adding is
    reserved for changing an item's access control, which `SecItemUpdate`
    cannot do.
-6. `SecItem*` calls must not run on the main actor. Isolate them in an actor on
-   iOS 17 and later,
-   or a private serial queue for older targets.
+6. `SecItem*` calls must not run on the main actor. Isolate them in an actor
+   (available from iOS 13) or, in completion-handler code, a private serial
+   queue.
 7. On macOS, pass `kSecUseDataProtectionKeychain: true` unless the code is
    deliberately working with the legacy file-based keychain.
 8. Never encrypt twice with the same AES-GCM nonce under one key.
@@ -111,9 +111,10 @@ These answers apply across every reference file in this skill.
   `.privateKeyUsage` in its flags, for example
   `[.privateKeyUsage, .biometryCurrentSet]`.
 - Any code path that shows Face ID needs `NSFaceIDUsageDescription` in
-  `Info.plist`. Apple's LocalAuthentication documentation warns that requests
-  can fail without it, and that applies to keychain reads that trigger Face ID
-  as much as to `evaluatePolicy`.
+  `Info.plist`. The `LAContext` header asks apps to supply it, shows its string
+  the first time Face ID is used, and fails evaluations with
+  `LAError.biometryNotAvailable` once the user denies Face ID for the app. That
+  applies to keychain reads that trigger Face ID as much as to `evaluatePolicy`.
 - `arc4random` on Apple platforms is backed by a cryptographically secure
   generator, not RC4. Its limits are a 32-bit result and the bias of `% n`. For
   keys, nonces, salts and tokens, use `SecRandomCopyBytes`,
@@ -130,7 +131,8 @@ in hardware, and checks of server trust. Adjacent topics appear here only to
 point at the right skill:
 
 - `authentication`: passkeys, Sign in with Apple, OAuth sign-in flows,
-  `ASAuthorizationController`, credential state, sign-in UX.
+  `ASAuthorizationController`, credential state, sign-in UX, and `LAContext`
+  prompts and policy that do not guard a keychain item.
 - `cryptokit`: CryptoKit questions with no storage, keychain, Secure Enclave,
   trust or compliance angle.
 - `device-integrity`: DeviceCheck and App Attest attestations and assertions.

package/pipeline/skills/shared/external/swift-security/references/certificate-trust.md

@@ -4,7 +4,8 @@ What is here: the Security types for certificates, trust, identities and policie
 pinning, whether by leaf, by issuing CA, by public-key digest or declaratively through
 `NSPinnedDomains`; building your own trust policy; mutual TLS; the points where App
 Transport Security and trust evaluation overlap; and running a pin set in production.
-It applies from iOS 12 through iOS 18 and macOS 10.14 through 15.
+It applies from iOS 12 and macOS 10.14 through the current releases (checked
+against the iOS 26.4 SDK).
 
 What is not here: transport concerns other than checking TLS certificates, managing
 certificates on your servers, and ATS as a configuration topic (the `ios-networking`
@@ -72,7 +73,7 @@ func checkTrustOffMain(_ trust: SecTrust, then report: @escaping @Sendable (Trus
 `nonisolated(unsafe)`: the caller promises not to touch the trust while it is
 being evaluated. `report` is `@Sendable` because it runs on that queue.
 
-Apple has not added async/await versions of these calls as of iOS 18. A continuation
+The iOS 26.4 SDK still has no async/await version of these calls. A continuation
 bridges the gap:
 
 ```swift
@@ -477,7 +478,8 @@ Storing certificates and identities in the Keychain is covered in
 - ATS requires, for every `URLSession` connection: TLS 1.2 or later, RSA keys of at
   least 2048 bits or ECC of at least 256 bits, SHA-256 or stronger certificate
   signatures, AES-128 or AES-256, and forward secrecy.
-- From iOS 17, ATS also requires HTTPS when connecting to a bare IP address.
+- For connections to IP-address literals, check Apple's `NSAppTransportSecurity`
+  documentation for how ATS applies on the deployment target.
 - Keys that draw App Review scrutiny: `NSAllowsArbitraryLoads`,
   `NSAllowsArbitraryLoadsForMedia`, `NSAllowsArbitraryLoadsInWebContent`,
   `NSExceptionAllowsInsecureHTTPLoads`, `NSExceptionMinimumTLSVersion`.
@@ -491,8 +493,9 @@ Storing certificates and identities in the Keychain is covered in
 | iOS 13 / macOS 10.15 | `SecTrustEvaluateAsyncWithError`; `SecTrustEvaluate` deprecated |
 | iOS 14 / macOS 11 | `NSPinnedDomains`; `SecTrustCopyKey` replaces `SecTrustCopyPublicKey` |
 | iOS 15 / macOS 12 | `SecTrustCopyCertificateChain` replaces `SecTrustGetCertificateAtIndex` and `SecTrustGetCertificateCount` |
-| iOS 17 / macOS 14 | Connections to literal IPs fall under ATS; TLS 1.3 for EAP |
-| iOS 18 / macOS 15 | Trust API unchanged; the Swift 6 language mode makes the closure-based Security calls harder to adopt |
+| iOS 18 / macOS 15 | `SecCertificateCopyNotValidBeforeDate` and `SecCertificateCopyNotValidAfterDate` |
+| iOS 18.4 / macOS 15.4 | `kSecTrustQWACValidation`, `kSecTrustQCStatements` and the `kSecPolicyApple*` server and client policy constants |
+| iOS 26 / macOS 26 | No new trust-evaluation API; still no async/await form of `SecTrustEvaluateAsyncWithError` |
 
 ## Threads and performance
 

package/pipeline/skills/shared/external/swift-security/references/keychain-fundamentals.md

@@ -18,7 +18,7 @@ and Best Practices".
 - [Reading](#reading)
 - [One Place That Builds Queries](#one-place-that-builds-queries)
 - [OSStatus Codes](#osstatus-codes)
-- [An Actor Around the Keychain (iOS 17+ / macOS 14+)](#an-actor-around-the-keychain-ios-17--macos-14)
+- [An Actor Around the Keychain (iOS 13+ / macOS 10.15+)](#an-actor-around-the-keychain-ios-13--macos-1015)
 - [Performance](#performance)
 - [macOS: Two Keychains (TN3137)](#macos-two-keychains-tn3137)
 - [Accessibility at a Glance](#accessibility-at-a-glance)
@@ -85,8 +85,11 @@ Internet passwords are identified by account, server, protocol, authentication
 type, port, path, security domain, access group and synchronizable. See
 [keychain-item-classes.md](keychain-item-classes.md) for every class.
 
-`SecItemUpdate` cannot change `kSecAttrAccount` or `kSecClass`. To rename an
-account or change class, delete the old item and add a new one.
+`SecItemUpdate` cannot change `kSecClass`: the class belongs to the query,
+and the attributes dictionary accepts only real keychain attributes. To change
+class, delete the old item and add a new one. A primary-key attribute such as
+`kSecAttrAccount` can be updated; the update fails with `errSecDuplicateItem`
+only when another item already has the resulting primary key.
 
 ## Saving: Add, Then Update on Duplicate
 
@@ -257,7 +260,7 @@ its merits:
 | -128 | `errSecUserCanceled` | The user dismissed the prompt; tell the UI. |
 | -25293 | `errSecAuthFailed` | Authentication failed or the protected item is no longer usable. |
 | -50 | `errSecParam` | A programming error in the dictionary; fix the query. |
-| -25244 | `errSecNoSuchAttr` | The attribute is not supported (seen on the data protection keychain). |
+| -25303 | `errSecNoSuchAttr` | The attribute is not supported (seen on the data protection keychain). |
 
 ```swift
 struct KeychainError: Error, CustomStringConvertible {
@@ -272,7 +275,7 @@ struct KeychainError: Error, CustomStringConvertible {
 Logs may record the shape of a query (class, service, which flags were set)
 and the status code. They never record `kSecValueData`, tokens or key bytes.
 
-## An Actor Around the Keychain (iOS 17+ / macOS 14+)
+## An Actor Around the Keychain (iOS 13+ / macOS 10.15+)
 
 Reads of biometric-protected items wait for the user and can take several
 seconds (WWDC 2014 Session 711). Doing that on the main actor freezes the UI.
@@ -381,7 +384,8 @@ Why an actor rather than a queue:
 | `Sendable` | Enforced | Annotate `@Sendable` by hand |
 | Swift 6 | Native | Needs care to pass strict checking |
 
-For iOS 13 through 16, a private serial queue does the same job:
+In completion-handler code that has not moved to Swift concurrency, a private
+serial queue does the same job:
 
 ```swift
 final class LegacySecretStore {
@@ -450,7 +454,7 @@ func macSafe(_ query: [CFString: Any]) -> [CFString: Any] {
 
 When a macOS keychain bug appears, first confirm which backend the call went
 to. An attribute the file-based keychain quietly drops will produce
-`errSecNoSuchAttr` (-25244) on the data protection keychain.
+`errSecNoSuchAttr` (-25303) on the data protection keychain.
 
 ## Accessibility at a Glance
 
@@ -477,8 +481,8 @@ is a safe default for foreground use. The actor above defaults to
 2. Saves fall back to `SecItemUpdate` on -25299.
 3. Every `SecItemCopyMatching` sets at least one `kSecReturn*` key.
 4. The cast of the `CFTypeRef` result matches the return keys and match limit.
-5. No SecItem call runs on `@MainActor` (actor on iOS 17+, serial queue on
-   iOS 13 to 16).
+5. No SecItem call runs on `@MainActor` (an actor, available from iOS 13, or
+   a private serial queue in completion-handler code).
 6. Add, query and update dictionaries are built fresh for each call.
 7. Keys are `kSec*` constants, not string literals.
 8. Queries are specific: service and account for generic passwords,

package/pipeline/skills/shared/external/swift-security/references/secure-enclave.md

@@ -321,12 +321,13 @@ func pqRoundTrip() throws -> Bool {
 ```
 
 Transport needs no work: in iOS 26, `URLSession` and `Network.framework`
-negotiate quantum-secure TLS 1.3 with X-Wing (ML-KEM768 combined with X25519)
-on their own, and CloudKit, push notifications and iCloud Private Relay already
-use it. For an app's own end-to-end encryption, prefer a hybrid of
-post-quantum and classical algorithms, such as the `XWingMLKEM768X25519` KEM in
-HPKE; an `SecureEnclave.MLKEM768.PrivateKey` performs encapsulation and
-decapsulation inside the hardware. The full CryptoKit catalog is in
+negotiate quantum-secure TLS 1.3 on their own, offering the hybrid
+`X25519MLKEM768` key-exchange group, and CloudKit, push notifications and
+iCloud Private Relay already use it. For an app's own end-to-end encryption,
+prefer a hybrid of post-quantum and classical algorithms, such as the CryptoKit
+X-Wing KEM (`XWingMLKEM768X25519`) in HPKE; an
+`SecureEnclave.MLKEM768.PrivateKey` performs encapsulation and decapsulation
+inside the hardware. The full CryptoKit catalog is in
 [cryptokit-public-key.md](cryptokit-public-key.md).
 
 | Release | Enclave-related change |

package/pipeline/skills/shared/external/swift-testing/SKILL.md

@@ -218,7 +218,7 @@ API you correct.
 | API | Needs |
 |-----|-------|
 | Exit tests (`processExitsWith:`) | Swift 6.2, Xcode 26.0; not iOS, tvOS, watchOS |
-| Capture lists in exit tests | Swift 6.3 compiler; captured values must be `Sendable` and `Codable` |
+| Capture lists in exit tests | Compiles with the Swift 6.3.1 compiler (Xcode 26.4); earlier compilers not checked. Captured values must be `Sendable` and `Codable` |
 | `Test.cancel(_:)`, `Issue.record(_:severity:)`, image attachments | Swift 6.3, Xcode 26.4 |
 
 ```swift
@@ -230,9 +230,12 @@ API you correct.
 }
 ```
 
-Give each captured value an explicit type (`[name = name as Type]`). A bare
-`[status]` fails to compile with "Type of captured value is ambiguous",
-because the macro cannot infer the type on its own.
+Give each captured value an explicit type (`[name = name as Type]`). With the
+Swift 6.3.1 compiler a bare `[status]` fails with "Type of captured value
+'status' is ambiguous", a captured value that is not `Codable` fails with "must
+conform to 'Sendable' and 'Codable'", and a closure that reads `status` with no
+capture list fails with "a C function pointer cannot be formed from a closure
+that captures context".
 
 A test that calls `Test.cancel(_:)` must be `throws` or `async throws`.
 
@@ -241,7 +244,7 @@ A test that calls `Test.cancel(_:)` must be `throws` or `async throws`.
 | Found | Replace with |
 |-------|--------------|
 | `#expect(exitsWith:)` | `await #expect(processExitsWith: .failure) { ... }`. In an iOS app target, test the logic behind a smaller API that does not exit, or move the exit test to a supported host or tool target. |
-| Exit-test closure reading outer values with no capture list | An explicit, typed capture list (`[code = code as Int32]`); Swift 6.3 compiler; values `Sendable` and `Codable` |
+| Exit-test closure reading outer values with no capture list | An explicit, typed capture list (`[code = code as Int32]`); verified with Swift 6.3.1; values `Sendable` and `Codable` |
 | `Test.cancel()` in a test that is not throwing | Mark the test `async throws` and call `try Test.cancel("reason")` |
 | A warning that should not fail the run | `Issue.record("message", severity: .warning)`: reported, test still passes; Swift 6.3, Xcode 26.4 |
 | `Attachment(image, named:).record()` | `Attachment.record(image, named: "...", as: .png)`; accepts `UIImage`, `CGImage`, `CIImage`, `NSImage`; Swift 6.3, Xcode 26.4 |

package/pipeline/skills/shared/external/swift-testing/evals/evals.json

@@ -23,7 +23,7 @@
       "assertions": [
         "Replaces exitsWith: with await #expect(processExitsWith: .failure).",
         "States that exit tests need Swift 6.2 and Xcode 26.0 and do not run on iOS, tvOS or watchOS, and suggests testing the non-exiting logic in the app target.",
-        "Adds an explicit capture list for badCode, requiring the Swift 6.3 compiler and Sendable plus Codable values.",
+        "Adds an explicit, typed capture list for badCode, notes it was verified with the Swift 6.3.1 compiler, and requires Sendable plus Codable values.",
         "Makes the cancelling test async throws (or throws) and calls try Test.cancel.",
         "Uses Issue.record with severity: .warning and names the Swift 6.3 and Xcode 26.4 gate.",
         "Uses Attachment.record(chartImage, named:, as: .png) and names the Swift 6.3 and Xcode 26.4 gate."

package/pipeline/skills/shared/external/swift-testing/references/testing-advanced.md

@@ -52,7 +52,8 @@ and reports it as cancelled: neither passed nor failed.
 ## Capturing Values in Exit Tests
 
 ST-0012 lets an exit test's closure capture values from the surrounding scope.
-It needs the Swift 6.3 compiler. Exit tests themselves arrived in Swift 6.2
+It compiles with the Swift 6.3.1 compiler in Xcode 26.4; earlier compilers were
+not checked. Exit tests themselves arrived in Swift 6.2
 (Xcode 26.0) through the `processExitsWith:` macros. Captured values must be
 `Sendable` and `Codable`, because they are sent to the child process.
 
@@ -101,7 +102,7 @@ import UIKit
 |---------|---------|
 | Attachments of standard values | Swift 6.2, Xcode 26.0 |
 | Exit tests with `processExitsWith:` | Swift 6.2, Xcode 26.0; macOS, Linux, FreeBSD, OpenBSD, Windows |
-| Capture lists in exit tests | Swift 6.3 compiler |
+| Capture lists in exit tests | Verified with the Swift 6.3.1 compiler (Xcode 26.4) |
 | `Issue.record(_:severity:)`, `Test.cancel(_:)`, image attachments | Swift 6.3, Xcode 26.4 |
 
 iOS, tvOS and watchOS have no exit tests. Put the exiting behaviour behind a

package/pipeline/skills/shared/external/swiftdata/SKILL.md

@@ -35,9 +35,11 @@ shipped without a migration plan.
 
 ## Defining models
 
-`@Model` only applies to classes. It adds conformance to `PersistentModel`,
-`Observable` and `Sendable`, so a model needs reference semantics and a
-designated initializer.
+`@Model` only applies to classes. It adds conformance to `PersistentModel`
+(which refines `Observable`, `Hashable` and `Identifiable`), so a model needs
+reference semantics and a designated initializer. Model instances are not
+`Sendable`: to hand a model to another actor, pass its `PersistentIdentifier`
+(which is `Sendable`) and fetch it again from that actor's context.
 
 ```swift
 import SwiftData

package/pipeline/skills/shared/external/swiftui-navigation/SKILL.md

@@ -188,19 +188,24 @@ struct RootTabs: View {
 The custom binding sends every change through `select`, so a tab like
 "New" can run an action instead of becoming the selected tab.
 
-### iOS 26 additions
+### Tab APIs from iOS 18 and iOS 26
 
-- `Tab(role: .search)` turns the tab bar into a search field while that tab is
-  active.
-- `.tabBarMinimizeBehavior(_:)` with `.onScrollDown`, `.onScrollUp` or `.never`.
-  iPhone only.
+From iOS 18 (macOS 15):
+
+- `Tab(role: .search)` marks the search tab; the iOS 26 tab bar shows it as a
+  search field while that tab is active.
 - `.tabViewSidebarHeader { }` and `.tabViewSidebarFooter { }` customise the
   sidebar on iPadOS and macOS.
-- `.tabViewBottomAccessory { }` pins a view just above the tab bar, such as a
-  mini player.
 - `TabSection` collects tabs under a sidebar heading; mark it with
   `.tabPlacement(.sidebarOnly)` to keep it out of the compact bar.
 
+From iOS 26 only:
+
+- `.tabBarMinimizeBehavior(_:)` with `.onScrollDown`, `.onScrollUp` or `.never`.
+  iPhone only.
+- `.tabViewBottomAccessory { }` pins a view just above the tab bar, such as a
+  mini player.
+
 More in [references/tabview.md](references/tabview.md).
 
 ## Deep links
@@ -259,7 +264,10 @@ Details, AASA format and scheme parsing: [references/deeplinks.md](references/de
 - Driving a model-backed sheet with `.sheet(isPresented:)` instead of
   `.sheet(item:)`.
 - Putting views in the path. The path holds small `Hashable` route values.
-- Holding an `@Observable` router as a property of another `@Observable` object.
+- Writing `NavigationStack(path: $router.path)` where `router` is a plain `let`
+  or comes from `@Environment`. That gives no binding and does not compile;
+  declare the property `@Bindable var router: Router`, or add
+  `@Bindable var router = router` inside `body`.
 - Building tabs with the older `.tabItem { }` instead of `Tab(value:)` with
   `TabView(selection:)`.
 - Expecting `tabBarMinimizeBehavior` to do anything on iPad. It is iPhone only.
@@ -285,5 +293,5 @@ Details, AASA format and scheme parsing: [references/deeplinks.md](references/de
 
 - [references/navigationstack.md](references/navigationstack.md): routers, per-tab stacks, centralised destinations, data-driven tabs
 - [references/sheets.md](references/sheets.md): enum sheet routing, sizing, dismissal confirmation
-- [references/tabview.md](references/tabview.md): tab architecture, custom selection binding, dynamic tabs, iOS 26 tab API
+- [references/tabview.md](references/tabview.md): tab architecture, custom selection binding, dynamic tabs, the iOS 18 and iOS 26 tab APIs
 - [references/deeplinks.md](references/deeplinks.md): router URL handling, universal links and AASA, custom schemes, Handoff

package/pipeline/skills/shared/external/swiftui-navigation/references/navigationstack.md

@@ -172,5 +172,7 @@ struct DynamicTabs: View {
 - A path shared across tabs, unless you really want one global history.
 - Route identifiers that are not stable or not `Hashable`.
 - View instances stored in the path instead of route data.
-- A router stored inside another `@Observable` object; keep it standalone to
-  avoid nested observation.
+- A router passed as a plain `let` or read from `@Environment` and then used as
+  `$router.path`: no binding exists without `@Bindable`, so the stack view needs
+  `@Bindable var router: Router` (as `ExploreStack` has) or a local
+  `@Bindable var router = router` in `body`.

package/pipeline/skills/shared/external/swiftui-navigation/references/tabview.md

@@ -107,7 +107,7 @@ enum AppTab: Hashable, Identifiable {
 }
 ```
 
-## iOS 26 tab API
+## Tab APIs from iOS 18 and iOS 26
 
 ```swift
 TabView {
@@ -121,20 +121,27 @@ TabView {
 .tabViewSidebarBottomBar { SettingsButton() }
 ```
 
-- `TabBarMinimizeBehavior`: `.automatic` (decided by context), `.onScrollDown`,
-  `.onScrollUp` and `.never`. The two scroll behaviours apply on iPhone only.
-- `Tab(role: .search)` replaces the bar with a search field while that tab is
-  active.
+iOS 18 (macOS 15, visionOS 2):
+
+- `Tab(role: .search)` marks the search tab; the iOS 26 tab bar replaces the bar
+  with a search field while that tab is active.
 - Sidebar customisation: `.tabViewSidebarHeader { }`,
   `.tabViewSidebarFooter { }` and `.tabViewSidebarBottomBar { }`.
+- `TabSection` and `.tabPlacement(_:)`.
+
+iOS 26 only:
+
+- `TabBarMinimizeBehavior`: `.automatic` (decided by context), `.onScrollDown`,
+  `.onScrollUp` and `.never`. The two scroll behaviours apply on iPhone only.
 - `.tabViewBottomAccessory { }` shows content just above the tab bar; its
   placement is described by `TabViewBottomAccessoryPlacement`.
 
+The example mixes both groups, so as written it needs iOS 26.
+
 ## Pitfalls
 
 - A view model per tab. Keep state local to views or in shared `@Observable`
   services.
-- `@Observable` objects nested inside each other.
 - An `AppTab.id` that changes between launches; dynamic cases must hash on a
   stable identifier.
 - Special tabs such as compose that change the selection.

package/pipeline/skills/shared/external/weatherkit/SKILL.md

@@ -68,8 +68,9 @@ headline = "\(now.temperature.formatted()), \(now.condition.description)"
 
 ### Hourly
 
-By default the hourly forecast covers 25 consecutive hours starting with the
-current hour. `hourlyForecast` is a `Forecast<HourWeather>`:
+At the time of writing, Apple's documentation says the default hourly forecast
+covers 25 consecutive hours starting with the current hour; read the count from
+the result rather than hard-coding it. `hourlyForecast` is a `Forecast<HourWeather>`:
 
 ```swift
 let timeline = report.hourlyForecast.map { slot in
@@ -79,7 +80,9 @@ let timeline = report.hourlyForecast.map { slot in
 
 ### Daily
 
-By default the daily forecast covers 10 consecutive days starting today.
+At the time of writing, Apple's documentation says the default daily forecast
+covers 10 consecutive days starting today; again, read the count from the
+result.
 `dailyForecast` is a `Forecast<DayWeather>`:
 
 ```swift
@@ -145,8 +148,8 @@ if let nextHour = try await forecaster.weather(for: site, including: .minute) {
 | Query | Result type | Notes |
 | --- | --- | --- |
 | `.current` | `CurrentWeather` | |
-| `.hourly` | `Forecast<HourWeather>` | 25 hours from now |
-| `.daily` | `Forecast<DayWeather>` | 10 days from today |
+| `.hourly` | `Forecast<HourWeather>` | Default span per Apple's docs: 25 hours from now |
+| `.daily` | `Forecast<DayWeather>` | Default span per Apple's docs: 10 days from today |
 | `.minute` | `Forecast<MinuteWeather>?` | `nil` where unsupported |
 | `.alerts` | `[WeatherAlert]?` | `nil` where unsupported |
 | `.availability` | `WeatherAvailability` | Which region-limited datasets exist here |