@mmerterden/multi-agent-pipeline 20.8.0 → 20.8.2

package/pipeline/skills/shared/external/localization-reuse-map/scripts/verify-map.py

@@ -11,47 +11,16 @@ import os
 import re
 import sys
 
-EXTENSIONS = {".swift", ".kt", ".kts", ".xml", ".ts", ".tsx", ".js", ".jsx", ".vue"}
-SKIP_PARTS = ("/.git", "/Generated/")
-
-WORD = "A-Za-z0-9_"
-LSK = re.compile(rf"LocalizationStringKey((?:\.[A-Za-z_][{WORD}]*)+)")
-LITERAL_LOCALIZED = re.compile(rf"\"([{WORD}.]+)\"\.localized\b")
-WEB_T = re.compile(r"(?<![\w$])t\(\s*(['\"])([A-Za-z0-9_.\-]+)\1")
-WEB_DOLLAR_T = re.compile(r"\$t\(\s*(['\"])([A-Za-z0-9_.\-]+)\1")
-TRAILING_MARKER = re.compile(r"\s*\([^()]*\)\s*$")
-COMPONENT_MARKER = re.compile(r"\([^)]*(owned by|bile\u015fen|component)[^)]*\)", re.IGNORECASE)
-PLACEHOLDER = re.compile(r"<[^<>]+>")
-
-
-def strip_accessor(chain):
-    segments = chain.strip(".").split(".")
-    while segments and segments[-1].startswith("localized"):
-        segments.pop()
-    return ".".join(segments)
-
-
-def normalize_key(key):
-    return ".".join(seg[:1].upper() + seg[1:] for seg in key.split("."))
-
-
-def source_files(root):
-    if os.path.isfile(root):
-        yield root
-        return
-    for current, dirs, files in os.walk(root):
-        probe = current.replace(os.sep, "/") + "/"
-        if any(part in probe for part in SKIP_PARTS):
-            dirs[:] = []
-            continue
-        for name in sorted(files):
-            if os.path.splitext(name)[1] in EXTENSIONS:
-                yield os.path.join(current, name)
+from _shared import (
+    ACCESSOR_EXTENSIONS, DEFAULT_KEY_TYPES, LITERAL_KEY, WEB_DOLLAR_T, WEB_T, clean_key, is_component, is_dynamic,
+    key_type_warning, key_types, lsk_keys, normalize_key, raw_key, source_files,
+)
 
 
-def scan_code(root):
+def scan_code(root, types=DEFAULT_KEY_TYPES):
     keys = set()
     corpus = []
+    accessor_texts = []
     scanned = 0
     for path in source_files(root):
         try:
@@ -61,28 +30,16 @@ def scan_code(root):
             continue
         scanned += 1
         corpus.append(text.lower())
-        chains = (strip_accessor(hit.group(1)) for hit in LSK.finditer(text))
-        keys.update(chain.lower() for chain in chains if chain)
-        for pattern, group in ((LITERAL_LOCALIZED, 1), (WEB_T, 2), (WEB_DOLLAR_T, 2)):
+        if os.path.splitext(path)[1] in ACCESSOR_EXTENSIONS:
+            accessor_texts.append(text)
+        keys.update(key.lower() for key in lsk_keys(text, types))
+        for pattern, group in ((LITERAL_KEY, 1), (WEB_T, 2), (WEB_DOLLAR_T, 2)):
             keys.update(hit.group(group).lower() for hit in pattern.finditer(text))
-    return keys, "\n".join(corpus), scanned
-
+    return keys, "\n".join(corpus), scanned, key_type_warning(accessor_texts, types, mapping_hint=True)
 
-def is_component(row):
-    text = " ".join(str(row.get(f) or "") for f in ("newKey", "element", "note"))
-    return bool(COMPONENT_MARKER.search(text))
 
-
-def is_dynamic(row, key):
-    element = str(row.get("element") or "").lower()
-    note = str(row.get("note") or "").lower()
-    return (
-        key.startswith("(dynamic")
-        or bool(PLACEHOLDER.search(key))
-        or "dinamik" in element
-        or "dynamic" in element
-        or "enumerate at runtime" in note
-    )
+def filled(value):
+    return bool(str(value or "").strip())
 
 
 def suggested_exists(root, key):
@@ -100,12 +57,26 @@ def main():
     parser.add_argument("--screen-path", required=True, help="folder or single file of the built screen")
     parser.add_argument("--resources-root", help="resources checkout or snapshot; turns on the Suggested-file check")
     parser.add_argument("--out", help="JSON report destination; stdout when omitted")
+    parser.add_argument(
+        "--key-type", action="append", metavar="NAME",
+        help="type whose member chains are keys; repeatable or comma list. Falls back to the mapping's "
+             f"keyType, then {', '.join(DEFAULT_KEY_TYPES)}",
+    )
     args = parser.parse_args()
 
     with open(args.mapping, encoding="utf-8") as stream:
         mapping = json.load(stream)
     rows = mapping.get("rows") or []
-    code_keys, corpus, scanned = scan_code(args.screen_path)
+    from_mapping = mapping.get("keyType") or []
+    if isinstance(from_mapping, str):
+        from_mapping = [from_mapping]
+    elif not (isinstance(from_mapping, list) and all(isinstance(name, str) for name in from_mapping)):
+        parser.error(f"keyType in the mapping must be a string or a list of strings, got {from_mapping!r}")
+    try:
+        types = key_types(args.key_type or from_mapping)
+    except ValueError as exc:
+        parser.error(str(exc))
+    code_keys, corpus, scanned, type_warning = scan_code(args.screen_path, types)
 
     verified = 0
     exempt = 0
@@ -114,8 +85,7 @@ def main():
     map_keys = set()
 
     for row in rows:
-        raw_key = str(row.get("newKey") or "").strip()
-        key = raw_key if raw_key.startswith("(dynamic") else TRAILING_MARKER.sub("", raw_key)
+        key = clean_key(raw_key(row))
         component = is_component(row)
         dynamic = is_dynamic(row, key)
         if key:
@@ -136,11 +106,11 @@ def main():
         verdict = row.get("verdict")
         new = row.get("new") or {}
         legacy = row.get("legacy") or {}
-        if verdict != "new" and not new.get("tr") and not dynamic:
+        if verdict != "new" and not filled(new.get("tr")) and not dynamic:
             gaps.append({"key": key, "issue": "new.tr empty"})
-        if verdict in ("reuse", "review") and not (legacy.get("en") or legacy.get("tr")):
+        if verdict in ("reuse", "review") and not (filled(legacy.get("en")) or filled(legacy.get("tr"))):
             gaps.append({"key": key, "issue": f"verdict={verdict} but no legacy value"})
-        if new.get("tr") and new.get("tr") == new.get("en"):
+        if filled(new.get("tr")) and new.get("tr") == new.get("en"):
             untranslated.append(key)
         if args.resources_root and not component and not dynamic and key and not suggested_exists(args.resources_root, key):
             gaps.append({"key": key, "issue": f"no Suggested/{normalize_key(key)}.json"})
@@ -160,6 +130,8 @@ def main():
         "valueGaps": gaps,
         "untranslated": untranslated,
     }
+    if type_warning:
+        report["keyTypeWarning"] = type_warning
     text = json.dumps(report, indent=2, ensure_ascii=False) + "\n"
     if args.out:
         with open(args.out, "w", encoding="utf-8") as sink:
@@ -175,6 +147,8 @@ def main():
         f"value gaps {len(gaps)} ({len(no_legacy)} hard), untranslated {len(untranslated)}",
         file=sys.stderr,
     )
+    if type_warning:
+        print(f"# {type_warning}", file=sys.stderr)
     for item in unverified[:12]:
         print(f"#   UNVERIFIED {item['key']}  ({item['element']})", file=sys.stderr)
     for key in not_in_map[:12]:
@@ -182,7 +156,7 @@ def main():
     if hard:
         print(f"# FAIL: {hard} hard issue(s); fix them or record a conscious waiver before publishing", file=sys.stderr)
         sys.exit(2)
-    print("# PASS", file=sys.stderr)
+    print("# PASS, but see the key type WARNING above" if type_warning else "# PASS", file=sys.stderr)
 
 
 if __name__ == "__main__":

package/pipeline/skills/shared/external/mapkit-location/SKILL.md

@@ -309,9 +309,11 @@ func lookUp(_ text: String) async throws -> MKMapItem? {
 Reverse lookup is `MKReverseGeocodingRequest(location:)`. Formatting and
 batch lookups are in [Geocoding and Places on iOS 26](references/mapkit-patterns.md#geocoding-and-places-on-ios-26).
 
-### CLGeocoder (iOS 5 to iOS 25, deprecated in iOS 26)
+### CLGeocoder (available since iOS 5, deprecated in iOS 26)
 
-Use it only while the deployment target is below iOS 26. Every `CLPlacemark`
+Use it only while the deployment target is below iOS 26. The SDK's deprecation
+messages point reverse lookups to `MKReverseGeocodingRequest` and forward
+lookups to `MKGeocodingRequest`. Every `CLPlacemark`
 field is optional. `CLGeocoder` is not `Sendable`, so Swift 6 rejects one
 shared global instance; make a geocoder for each lookup instead.
 

package/pipeline/skills/shared/external/passkit-wallet/SKILL.md

@@ -14,10 +14,11 @@ charges.
 Examples assume Swift 6.3 and iOS 26.
 
 One rule shapes advanced checkouts: a single `PKPaymentRequest` may carry at
-most one optional advanced type. The candidates are a recurring request, an
-automatic-reload request, a deferred request, the Apple Pay Later setting, and
-multi-token contexts. When a flow
-needs two of them, build two requests.
+most one of `multiTokenContexts`, `recurringPaymentRequest`,
+`automaticReloadPaymentRequest` and `deferredPaymentRequest`. When a flow
+needs two of them, build two requests. `applePayLaterAvailability` (iOS 17+)
+is not part of that rule; it is a separate opt-out of Apple Pay Later that
+defaults to enabled.
 
 ## Setup
 

package/pipeline/skills/shared/external/passkit-wallet/references/wallet-passes.md

@@ -10,10 +10,11 @@ Each `PKPaymentRequest` may set only one of these:
 - `recurringPaymentRequest`
 - `automaticReloadPaymentRequest`
 - `deferredPaymentRequest`
-- the Apple Pay Later availability setting
 - `multiTokenContexts`
 
-If a checkout needs two, split it into two requests.
+If a checkout needs two, split it into two requests. `applePayLaterAvailability`
+(iOS 17+) sits outside this rule: it opts the request out of Apple Pay Later,
+and defaults to enabled; the exclusion covers only the four above.
 
 ## Recurring payments
 

package/pipeline/skills/shared/external/pencilkit-drawing/SKILL.md

@@ -133,8 +133,8 @@ drawing throws there. `PKContentVersion` names each step:
 |---|---|
 | `.version1` | Original inks: pen, pencil, marker (iPadOS 14 era) |
 | `.version2` | Inks added in iPadOS 17: `.monoline`, `.fountainPen`, `.watercolor`, `.crayon` |
-| `.version3` | Barrel-roll angle data on strokes |
-| `.version4` | Reed pen |
+| `.version3` | The new fountain pen ink (iOS 17.5, macOS 14.5) |
+| `.version4` | The new reed pen ink (iOS 26, macOS 26, visionOS 26) |
 
 When reviewing compatibility, lay out this whole table before recommending a
 cap, and if the fix is a curated picker, say that `PKToolPicker(toolItems:)`

package/pipeline/skills/shared/external/pencilkit-drawing/evals/evals.json

@@ -19,7 +19,7 @@
       "id": 1,
       "name": "older-ipad-sync",
       "prompt": "Teachers annotate worksheets on new iPads and students open them on iPads still running iPadOS 16. Students report that some worksheets fail to open. Our plan is to set maximumSupportedContentVersion to .version2 on the canvas. Review the plan.",
-      "expected_output": "Explains that inks newer than the recipient supports make loading fail, gives the full content version map (version1 pen/pencil/marker, version2 the iPadOS 17 inks, version3 barrel-roll data, version4 reed pen), and says .version2 does not help iPadOS 16, which needs .version1 or a verified fallback drawing. The cap must be set on both canvas and tool picker. Notes .reed needs 26 and curated picker items need iOS 18 or visionOS 2.",
+      "expected_output": "Explains that inks newer than the recipient supports make loading fail, gives the full content version map (version1 pen/pencil/marker, version2 the iPadOS 17 inks, version3 the new fountain pen from iOS 17.5, version4 the new reed pen), and says .version2 does not help iPadOS 16, which needs .version1 or a verified fallback drawing. The cap must be set on both canvas and tool picker. Notes .reed needs 26 and curated picker items need iOS 18 or visionOS 2.",
       "files": [],
       "expectations": [
         "States that unsupported inks make older systems fail to load the drawing",

package/pipeline/skills/shared/external/pencilkit-drawing/references/pencilkit-patterns.md

@@ -168,7 +168,7 @@ func describe(_ sketch: PKDrawing) -> String {
     switch sketch.requiredContentVersion {
     case .version1: "pen, pencil, marker"
     case .version2: "adds monoline, fountain pen, watercolor, crayon"
-    case .version3: "adds barrel-roll angles"
+    case .version3: "adds the new fountain pen (iOS 17.5)"
     case .version4: "adds reed pen"
     @unknown default: "unknown future content"
     }
@@ -215,9 +215,9 @@ func downgradedCopy(of sketch: PKDrawing) -> PKDrawing {
 }
 ```
 
-Swapping the ink is not always enough. The copied paths can still carry newer
-data such as barrel-roll angles, which is why the result is checked again
-before upload.
+Swapping the ink is not always enough. The copies keep every other stroke
+property, and only `requiredContentVersion` says what the result needs, which
+is why the result is checked again before upload.
 
 ## A configurable SwiftUI wrapper
 

package/pipeline/skills/shared/external/permissionkit/SKILL.md

@@ -32,10 +32,14 @@ against the Xcode 26 SDK you ship with before relying on it.
 Add `@preconcurrency import PermissionKit`. The SwiftUI and UIKit/AppKit
 pieces (`PermissionButton`, `AskCenter.ask(_:in:)`) come in through
 cross-import overlays, so importing SwiftUI or UIKit next to PermissionKit is
-enough. The framework's types carry no `Sendable` annotations, so under Swift 6
-a plain import turns every `ask(_:in:)` call from the main actor into a
-"sending 'question' risks causing data races" error; `@preconcurrency` is what
-lets the examples below compile.
+enough. Most of the framework's types are not `Sendable`: `PermissionQuestion`
+(a class), `PermissionResponse`, `PermissionChoice`, `CommunicationTopic`,
+`AskCenter` and `CommunicationLimits` declare no conformance. The exceptions
+are `CommunicationHandle`, which is `Sendable`, and the SwiftUI views
+`PermissionButton` and `CommunicationLimitsButton`. Because the question is not
+`Sendable`, under Swift 6 a plain import turns every `ask(_:in:)` call from the
+main actor into a "sending 'question' risks causing data races" error;
+`@preconcurrency` is what lets the examples below compile.
 
 Do not add made-up entitlement keys for PermissionKit. If a signing
 requirement exists, it will be in Apple's documentation and in the Xcode
@@ -177,7 +181,11 @@ those.
 in which the child sends the question; it does not return the parent's
 answer. Decisions arrive later on `responses(for:)`. If the child backs out of
 the send sheet, no `PermissionResponse` ever arrives, so a pending request
-needs its own expiry or retry.
+needs its own expiry or retry. `PermissionQuestion` has a settable
+`expirationDate: Date?` (nil by default); once that date passes, the parent
+can no longer respond. Set it before asking to bound the window, then move the
+local entry to expired at the same date, since the SDK delivers nothing when a
+question lapses.
 
 ```swift
 @available(iOS 26.2, *)
@@ -233,7 +241,8 @@ examples are in the
 
 Track each question by `question.id` (a `UUID`). Since a cancelled send
 produces nothing, give every pending entry a way out: a retry, an expiry, or
-both. When a flow combines known-handle checks with responses, keep the
+both. When the question carries an `expirationDate`, use that date for the
+local expiry so the app and the parent's window close together. When a flow combines known-handle checks with responses, keep the
 bundle-identifier guard from the section above.
 
 ```swift

package/pipeline/skills/shared/external/permissionkit/references/permissionkit-patterns.md

@@ -186,7 +186,8 @@ print(q.expirationDate as Any)           // nil unless set
 ```
 
 A question exposes `id`, `choices` (each with a `title`), `defaultChoice` and
-an optional `expirationDate`.
+an optional, settable `expirationDate`; after that date the parent can no
+longer respond.
 
 ## Limits-check view model
 

package/pipeline/skills/shared/external/push-notifications/SKILL.md

@@ -425,9 +425,13 @@ func handleChatAction(_ action: String, threadID: String?, typed: String?) async
 ## Grouping
 
 Notifications with the same `threadIdentifier` (local) or `thread-id` (APNs)
-stack into one group; each distinct value is its own group. `summaryArgument`
-and `summaryArgumentCount` on the content feed the group's summary line, and a
-category can shape that line:
+stack into one group; each distinct value is its own group. Grouping comes
+only from that identifier. `summaryArgument` and `summaryArgumentCount` on
+`UNMutableNotificationContent` are deprecated as ignored on iOS 15 and later
+(watchOS 8, tvOS 15); do not set them. A category can still supply a summary
+format through `categorySummaryFormat` (iOS 12+, not deprecated). The argument
+list in that format is optional, and with the per-notification argument ignored
+a count-only format is the one to rely on:
 
 ```swift
 let chat = UNNotificationCategory(
@@ -435,7 +439,7 @@ let chat = UNNotificationCategory(
     actions: [],
     intentIdentifiers: [],
     hiddenPreviewsBodyPlaceholder: nil,
-    categorySummaryFormat: "%u new messages from %@",
+    categorySummaryFormat: "%u new messages",
     options: []
 )
 ```

package/pipeline/skills/shared/external/push-notifications/references/notification-patterns.md

@@ -385,7 +385,7 @@ enum NotificationCategories {
             actions: [reply, markRead],
             intentIdentifiers: [],
             hiddenPreviewsBodyPlaceholder: nil,
-            categorySummaryFormat: "%u more from %@",
+            categorySummaryFormat: "%u more messages",
             options: [.customDismissAction]
         )
 

package/pipeline/skills/shared/external/realitykit-ar/SKILL.md

@@ -147,16 +147,35 @@ apart.
   entities that carry `CollisionComponent` shapes. Use it to pick entities and
   target gestures, never to find planes.
 - For simple placement on a detected plane, use `AnchorEntity(.plane(...))`.
-- To intersect a real surface once, build an ARKit `ARRaycastQuery`, run it
-  with `ARSession.raycast(_:)`, and anchor with `AnchorEntity(raycastResult:)`.
+  This is the placement path inside `RealityView`: `RealityViewCameraContent`
+  exposes no `ARSession`, so there is nothing to raycast against there.
+- To intersect a real surface at a tapped point, host an `ARView` (through
+  `UIViewRepresentable`), call its `raycast(from:allowing:alignment:)`, and
+  anchor with `AnchorEntity(raycastResult:)`. The same view offers
+  `makeRaycastQuery(from:allowing:alignment:)` when an `ARRaycastQuery` is
+  needed for `arView.session.raycast(_:)`.
 
 ```swift
+import RealityKit
+import SwiftUI
+
+struct PlaneDropView: View {
+    var body: some View {
+        RealityView { content in
+            content.camera = .spatialTracking
+            let floor = AnchorEntity(.plane(.horizontal, classification: .any, minimumBounds: [0.3, 0.3]))
+            floor.addChild(ModelEntity(mesh: .generateBox(size: 0.1)))
+            content.add(floor)
+        }
+    }
+}
+
 @MainActor
-func placeOnSurface(_ item: Entity, query: ARRaycastQuery, session: ARSession, into content: RealityViewCameraContent) {
-    guard let hit = session.raycast(query).first else { return }
+func placeOnSurface(_ item: Entity, at point: CGPoint, in arView: ARView) {
+    guard let hit = arView.raycast(from: point, allowing: .estimatedPlane, alignment: .any).first else { return }
     let anchor = AnchorEntity(raycastResult: hit)
     anchor.addChild(item)
-    content.add(anchor)
+    arView.scene.addAnchor(anchor)
 }
 ```
 
@@ -283,7 +302,7 @@ store it when you plan to cancel it later, or drop it with `_ =` as here.
 - [ ] Interaction notes explain that `CollisionComponent` provides the hittable shape, paired with `InputTargetComponent`
 - [ ] A Handoffs line mentions `AccessibilityComponent` and sends detailed SwiftUI and accessibility policy to the sibling skills
 - [ ] Entity hit tests, `ray(...)` and ARKit surface raycasts are kept distinct
-- [ ] Surface placement uses `ARSession.raycast(_:)` with `AnchorEntity(raycastResult:)`
+- [ ] Surface placement inside `RealityView` uses `AnchorEntity(.plane(...))`; a tap raycast uses `ARView.raycast(from:allowing:alignment:)` with `AnchorEntity(raycastResult:)`
 - [ ] Per-frame logic uses `SceneEvents.Update`, not SwiftUI timers
 - [ ] Large scenes load with async `ModelEntity(named:)`, not `Entity.load(named:)`
 - [ ] Anchor targets match the kind of surface the feature needs

package/pipeline/skills/shared/external/realitykit-ar/evals/evals.json

@@ -23,7 +23,7 @@
         "States that hitTest finds collision shapes on virtual entities, not physical surfaces",
         "States that ray(through:in:to:) is not evidence of a real surface",
         "Suggests AnchorEntity(.plane(...)) for simple plane placement",
-        "Uses ARRaycastQuery with ARSession.raycast(_:) and AnchorEntity(raycastResult:) for one-shot placement",
+        "Notes that RealityViewCameraContent exposes no ARSession and uses ARView.raycast(from:allowing:alignment:) with AnchorEntity(raycastResult:) for one-shot tap placement",
         "Keeps collision shapes for entity interaction only"
       ]
     },

package/pipeline/skills/shared/external/skill-creator/template.md

@@ -1,6 +1,6 @@
 # Skill templates
 
-Two skeletons. Copy the one that matches the layer, fill it, then delete every line that fails the cut test. The toolkits use these frontmatter keys: `name`, `description`, `allowed-tools`, `user-invocable`, plus an optional `argument-hint`.
+Two skeletons. Copy the one that matches the layer, fill it, then delete every line that fails the cut test. The toolkits use these frontmatter keys: `name`, `description`, `allowed-tools`, `user-invocable`, plus an optional `argument-hint` and a `metadata` block with `version` (semver of the skill text) and `source` (`multi-agent-pipeline` for a first-party skill, otherwise `<upstream> (<license>)` for the upstream it derives from, which a `NOTICE-*.md` beside it must list). For a shared knowledge skill in the pipeline source the block with `source` is required: the pipeline's skill lint fails one that has none. Elsewhere the block is optional; drop it rather than leave a placeholder in it.
 
 ## Reference skill
 
@@ -10,6 +10,9 @@ name: {aspect-noun}
 description: "{What it covers} for {platform}. {When to reach for it}. Triggers: '{phrase}', '{phrase}', '{phrase}'."
 user-invocable: true
 allowed-tools: Bash, Read, Edit, Write, Glob, Grep
+metadata:
+  version: {x.y.z}
+  source: {multi-agent-pipeline | upstream}
 ---
 
 # {name} - {short title}
@@ -44,6 +47,9 @@ description: "{What it does} for {platform}, with {guardrails}. Use when {situat
 user-invocable: true
 argument-hint: "{args}"
 allowed-tools: Bash, Read
+metadata:
+  version: {x.y.z}
+  source: {multi-agent-pipeline | upstream}
 ---
 
 # {name} - {short title}

package/pipeline/skills/shared/external/storekit/references/core-patterns.md

@@ -99,7 +99,7 @@ struct RecipesApp: App {
     }
 
     private static func watchTransactions() -> Task<Void, Never> {
-        Task.detached(priority: .background) {
+        Task(priority: .background) {
             for await incoming in StoreKit.Transaction.updates {
                 if case .verified(let receipt) = incoming {
                     await EntitlementStore.shared.refresh()
@@ -114,6 +114,11 @@ struct RecipesApp: App {
 Unverified updates fall through untouched. For each verified one,
 entitlements are recomputed first and the transaction finished afterwards.
 
+A plain `Task` is enough here. It inherits the main actor from the `App`, but
+the loop spends its time suspended in `for await` and the entitlement refresh
+runs on the main-actor `EntitlementStore` anyway; `Task.detached` would only add
+a hop and drop the task-local values.
+
 ## Computing Entitlements
 
 ```swift

package/pipeline/skills/shared/external/swift-concurrency/SKILL.md

@@ -7,10 +7,11 @@ metadata:
 
 # Swift Concurrency
 
-Baseline: Swift 6.3 compilers and later. The aim of every change made with this
+Baseline: Swift 6.2 compilers and later. The aim of every change made with this
 skill is data-race safety through isolation and `Sendable`, reached with the
 smallest possible change in behavior. Features newer than Swift 6.0 name the
-release or proposal that introduced them.
+release or proposal that introduced them; the few that need Swift 6.3, such as
+`weak let` (SE-0481), are marked as 6.3 only.
 
 Not for the smallest fix to a single diagnostic (use `swift-concurrency-expert`)
 or a file-by-file review pass (use `swift-concurrency-pro`).

package/pipeline/skills/shared/external/swift-concurrency/references/concurrency-patterns.md

@@ -157,7 +157,7 @@ nonisolated struct OffMainBackupBatch {
 
 `weak let` declares a weak reference that is never reassigned. Because the
 binding cannot change, a type storing only `weak let` references to `Sendable`
-objects can itself be `Sendable`. Implemented in Swift 6.3.
+objects can itself be `Sendable`. Swift 6.3 only.
 
 ```swift
 final class SessionObserver: Sendable {

package/pipeline/skills/shared/external/swift-security/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: swift-security
-description: "Apple client security: Keychain (SecItem, kSecClass, OSStatus, iOS and macOS), Face ID/Touch ID (LAContext), CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, OAuth token and API key storage, SecTrust/SPKI pinning, keychain sharing, moving secrets out of UserDefaults or plists, OWASP MASVS/MASTG. Use when writing, reviewing or migrating code that stores secrets, holds keys or evaluates trust. Not for passkeys, App Attest or App Review."
+description: "Apple client security: Keychain (SecItem, kSecClass, OSStatus, iOS, macOS), Face ID/Touch ID keychain items, CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, OAuth token and API key storage, SecTrust/SPKI pinning, keychain sharing, moving secrets out of UserDefaults or plists, OWASP MASVS/MASTG. Use when writing, reviewing or migrating code that stores secrets, holds keys or evaluates trust. Not for passkeys, App Attest or App Review."
 metadata:
   source: multi-agent-pipeline
 ---
@@ -81,9 +81,9 @@ and should be worded that way.
    `errSecDuplicateItem`, call `SecItemUpdate`. Deleting and re-adding is
    reserved for changing an item's access control, which `SecItemUpdate`
    cannot do.
-6. `SecItem*` calls must not run on the main actor. Isolate them in an actor on
-   iOS 17 and later,
-   or a private serial queue for older targets.
+6. `SecItem*` calls must not run on the main actor. Isolate them in an actor
+   (available from iOS 13) or, in completion-handler code, a private serial
+   queue.
 7. On macOS, pass `kSecUseDataProtectionKeychain: true` unless the code is
    deliberately working with the legacy file-based keychain.
 8. Never encrypt twice with the same AES-GCM nonce under one key.
@@ -111,9 +111,10 @@ These answers apply across every reference file in this skill.
   `.privateKeyUsage` in its flags, for example
   `[.privateKeyUsage, .biometryCurrentSet]`.
 - Any code path that shows Face ID needs `NSFaceIDUsageDescription` in
-  `Info.plist`. Apple's LocalAuthentication documentation warns that requests
-  can fail without it, and that applies to keychain reads that trigger Face ID
-  as much as to `evaluatePolicy`.
+  `Info.plist`. The `LAContext` header asks apps to supply it, shows its string
+  the first time Face ID is used, and fails evaluations with
+  `LAError.biometryNotAvailable` once the user denies Face ID for the app. That
+  applies to keychain reads that trigger Face ID as much as to `evaluatePolicy`.
 - `arc4random` on Apple platforms is backed by a cryptographically secure
   generator, not RC4. Its limits are a 32-bit result and the bias of `% n`. For
   keys, nonces, salts and tokens, use `SecRandomCopyBytes`,
@@ -130,7 +131,8 @@ in hardware, and checks of server trust. Adjacent topics appear here only to
 point at the right skill:
 
 - `authentication`: passkeys, Sign in with Apple, OAuth sign-in flows,
-  `ASAuthorizationController`, credential state, sign-in UX.
+  `ASAuthorizationController`, credential state, sign-in UX, and `LAContext`
+  prompts and policy that do not guard a keychain item.
 - `cryptokit`: CryptoKit questions with no storage, keychain, Secure Enclave,
   trust or compliance angle.
 - `device-integrity`: DeviceCheck and App Attest attestations and assertions.

package/pipeline/skills/shared/external/swift-security/references/certificate-trust.md

@@ -4,7 +4,8 @@ What is here: the Security types for certificates, trust, identities and policie
 pinning, whether by leaf, by issuing CA, by public-key digest or declaratively through
 `NSPinnedDomains`; building your own trust policy; mutual TLS; the points where App
 Transport Security and trust evaluation overlap; and running a pin set in production.
-It applies from iOS 12 through iOS 18 and macOS 10.14 through 15.
+It applies from iOS 12 and macOS 10.14 through the current releases (checked
+against the iOS 26.4 SDK).
 
 What is not here: transport concerns other than checking TLS certificates, managing
 certificates on your servers, and ATS as a configuration topic (the `ios-networking`
@@ -72,7 +73,7 @@ func checkTrustOffMain(_ trust: SecTrust, then report: @escaping @Sendable (Trus
 `nonisolated(unsafe)`: the caller promises not to touch the trust while it is
 being evaluated. `report` is `@Sendable` because it runs on that queue.
 
-Apple has not added async/await versions of these calls as of iOS 18. A continuation
+The iOS 26.4 SDK still has no async/await version of these calls. A continuation
 bridges the gap:
 
 ```swift
@@ -477,7 +478,8 @@ Storing certificates and identities in the Keychain is covered in
 - ATS requires, for every `URLSession` connection: TLS 1.2 or later, RSA keys of at
   least 2048 bits or ECC of at least 256 bits, SHA-256 or stronger certificate
   signatures, AES-128 or AES-256, and forward secrecy.
-- From iOS 17, ATS also requires HTTPS when connecting to a bare IP address.
+- For connections to IP-address literals, check Apple's `NSAppTransportSecurity`
+  documentation for how ATS applies on the deployment target.
 - Keys that draw App Review scrutiny: `NSAllowsArbitraryLoads`,
   `NSAllowsArbitraryLoadsForMedia`, `NSAllowsArbitraryLoadsInWebContent`,
   `NSExceptionAllowsInsecureHTTPLoads`, `NSExceptionMinimumTLSVersion`.
@@ -491,8 +493,9 @@ Storing certificates and identities in the Keychain is covered in
 | iOS 13 / macOS 10.15 | `SecTrustEvaluateAsyncWithError`; `SecTrustEvaluate` deprecated |
 | iOS 14 / macOS 11 | `NSPinnedDomains`; `SecTrustCopyKey` replaces `SecTrustCopyPublicKey` |
 | iOS 15 / macOS 12 | `SecTrustCopyCertificateChain` replaces `SecTrustGetCertificateAtIndex` and `SecTrustGetCertificateCount` |
-| iOS 17 / macOS 14 | Connections to literal IPs fall under ATS; TLS 1.3 for EAP |
-| iOS 18 / macOS 15 | Trust API unchanged; the Swift 6 language mode makes the closure-based Security calls harder to adopt |
+| iOS 18 / macOS 15 | `SecCertificateCopyNotValidBeforeDate` and `SecCertificateCopyNotValidAfterDate` |
+| iOS 18.4 / macOS 15.4 | `kSecTrustQWACValidation`, `kSecTrustQCStatements` and the `kSecPolicyApple*` server and client policy constants |
+| iOS 26 / macOS 26 | No new trust-evaluation API; still no async/await form of `SecTrustEvaluateAsyncWithError` |
 
 ## Threads and performance