@mmerterden/multi-agent-pipeline 20.9.0 → 20.11.0

package/pipeline/scripts/probe-store-key.mjs

@@ -0,0 +1,306 @@
+#!/usr/bin/env node
+/**
+ * @file probe-store-key.mjs  -  does a store key work, asked before it is saved.
+ *
+ * Setup stores the App Store Connect .p8 and the Google Play service-account
+ * JSON in the Keychain. A key that is saved first and tried later fails at the
+ * first store_* call, long after the person who could fix it has moved on, so
+ * setup runs this against the file on disk and saves only on ok.
+ *
+ *   --asc  --key-id <id> --issuer-id <id> --p8 <path>
+ *       Signs an ES256 token (aud appstoreconnect-v1, 10 minute lifetime) and
+ *       reads GET /v1/apps?limit=1.
+ *   --play --service-account <path>
+ *       Exchanges an RS256 jwt-bearer assertion at oauth2.googleapis.com for
+ *       the androidpublisher + playdeveloperreporting scopes, then reads
+ *       GET /v1beta1/apps:search?pageSize=1 on the Play Developer Reporting API.
+ *
+ * Prints one JSON line {ok, store, status, hint}. Key material, the signed
+ * assertion and the access token never reach stdout, stderr or argv.
+ *
+ * Exit: 0 accepted, 1 rejected or unreachable, 2 usage error.
+ */
+
+import { createPrivateKey, sign } from "node:crypto";
+import { readFileSync, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const ASC_URL = "https://api.appstoreconnect.apple.com/v1/apps?limit=1";
+export const GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
+export const PLAY_URL =
+  "https://playdeveloperreporting.googleapis.com/v1beta1/apps:search?pageSize=1";
+export const PLAY_SCOPES = [
+  "https://www.googleapis.com/auth/androidpublisher",
+  "https://www.googleapis.com/auth/playdeveloperreporting",
+];
+const ASC_TOKEN_SECONDS = 600;
+const GOOGLE_ASSERTION_SECONDS = 3600;
+const MAX_KEY_FILE_BYTES = 64 * 1024;
+const TIMEOUT_MS = 15000;
+
+export class UsageError extends Error {}
+
+const b64url = (input) =>
+  Buffer.from(typeof input === "string" ? input : JSON.stringify(input)).toString("base64url");
+
+const expandHome = (p) =>
+  p === "~" ? homedir() : p.startsWith("~/") ? join(homedir(), p.slice(2)) : p;
+
+function readKeyFile(path, what) {
+  const p = expandHome(path);
+  let size;
+  try {
+    size = statSync(p).size;
+  } catch {
+    throw new UsageError(`${what} file not found: ${p}`);
+  }
+  if (size > MAX_KEY_FILE_BYTES)
+    throw new UsageError(`${what} file is too large to be a key: ${p}`);
+  return readFileSync(p, "utf8");
+}
+
+/**
+ * The App Store Connect bearer token. ES256 with the raw r||s signature the
+ * JOSE spec requires, which node:crypto produces only with dsaEncoding
+ * "ieee-p1363"; its DER default is rejected by Apple as a bad signature.
+ */
+export function ascToken({ keyId, issuerId, privateKey, now = Date.now() }) {
+  const key = createPrivateKey(privateKey);
+  if (key.asymmetricKeyType !== "ec") throw new UsageError("the .p8 is not an EC private key");
+  const iat = Math.floor(now / 1000);
+  const data = `${b64url({ alg: "ES256", kid: keyId, typ: "JWT" })}.${b64url({
+    iss: issuerId,
+    iat,
+    exp: iat + ASC_TOKEN_SECONDS,
+    aud: "appstoreconnect-v1",
+  })}`;
+  const sig = sign("sha256", Buffer.from(data), { key, dsaEncoding: "ieee-p1363" });
+  return `${data}.${sig.toString("base64url")}`;
+}
+
+export function parseServiceAccount(text) {
+  let sa;
+  try {
+    sa = JSON.parse(text);
+  } catch {
+    throw new UsageError("the service-account file is not JSON");
+  }
+  if (!sa || sa.type !== "service_account" || !sa.client_email || !sa.private_key) {
+    throw new UsageError(
+      "the file is not a service-account key (needs type service_account, client_email, private_key)",
+    );
+  }
+  return sa;
+}
+
+export function playAssertion({ serviceAccount, now = Date.now() }) {
+  const key = createPrivateKey(serviceAccount.private_key);
+  const iat = Math.floor(now / 1000);
+  const header = { alg: "RS256", typ: "JWT" };
+  if (serviceAccount.private_key_id) header.kid = serviceAccount.private_key_id;
+  const data = `${b64url(header)}.${b64url({
+    iss: serviceAccount.client_email,
+    scope: PLAY_SCOPES.join(" "),
+    aud: GOOGLE_TOKEN_URL,
+    iat,
+    exp: iat + GOOGLE_ASSERTION_SECONDS,
+  })}`;
+  return `${data}.${sign("sha256", Buffer.from(data), key).toString("base64url")}`;
+}
+
+async function readBody(res) {
+  try {
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+
+async function request(fetchImpl, url, init) {
+  try {
+    return await fetchImpl(url, { ...init, signal: AbortSignal.timeout(TIMEOUT_MS) });
+  } catch (e) {
+    return { networkError: e?.cause?.code || e?.name || "network error" };
+  }
+}
+
+const unreachable = (store, res, host) => ({
+  ok: false,
+  store,
+  status: null,
+  hint: `${host} did not answer (${res.networkError}); check the network, then probe again`,
+});
+
+export function ascHint(status) {
+  if (status === 401) {
+    return "App Store Connect rejected the token: the key id and issuer id do not match this .p8, the key was revoked, or this machine's clock is off";
+  }
+  if (status === 403) {
+    return "the key authenticates but its role may not read apps; use a key with a role that can see the app (App Manager or Admin)";
+  }
+  return `App Store Connect answered ${status}`;
+}
+
+function isServiceDisabled(body) {
+  const err = body?.error;
+  if (!err) return false;
+  if ((err.details || []).some((d) => d?.reason === "SERVICE_DISABLED")) return true;
+  return /has not been used in project|is disabled/i.test(String(err.message || ""));
+}
+
+export function playHint(status, body, projectId) {
+  if (status === 403 && isServiceDisabled(body)) {
+    const where = projectId
+      ? ` in Google Cloud project ${projectId}`
+      : " in the service account's Google Cloud project";
+    return `enable the Google Play Android Developer API and the Google Play Developer Reporting API${where}, then probe again`;
+  }
+  if (status === 403) {
+    return "the service account authenticates but Play Console has not granted it access; invite it in Play Console -> Users and permissions with permissions for the app";
+  }
+  if (status === 401)
+    return "Google rejected the access token; generate a new key for the service account";
+  return `Play Developer Reporting answered ${status}`;
+}
+
+export async function probeAsc({ keyId, issuerId, privateKey, fetchImpl = fetch, now }) {
+  const token = ascToken({ keyId, issuerId, privateKey, now });
+  const res = await request(fetchImpl, ASC_URL, {
+    headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
+  });
+  if (res.networkError) return unreachable("appStoreConnect", res, "api.appstoreconnect.apple.com");
+  if (res.ok) return { ok: true, store: "appStoreConnect", status: res.status, hint: null };
+  return { ok: false, store: "appStoreConnect", status: res.status, hint: ascHint(res.status) };
+}
+
+export async function probePlay({ serviceAccount, fetchImpl = fetch, now }) {
+  const assertion = playAssertion({ serviceAccount, now });
+  const tokenRes = await request(fetchImpl, GOOGLE_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+      assertion,
+    }).toString(),
+  });
+  if (tokenRes.networkError) return unreachable("googlePlay", tokenRes, "oauth2.googleapis.com");
+  const tokenBody = await readBody(tokenRes);
+  if (!tokenRes.ok || !tokenBody?.access_token) {
+    const reason = tokenBody?.error ? ` (${String(tokenBody.error).slice(0, 40)})` : "";
+    return {
+      ok: false,
+      store: "googlePlay",
+      status: tokenRes.status,
+      hint: `Google refused the service-account assertion${reason}: the key was deleted or disabled, or this machine's clock is off`,
+    };
+  }
+  const res = await request(fetchImpl, PLAY_URL, {
+    headers: { Authorization: `Bearer ${tokenBody.access_token}`, Accept: "application/json" },
+  });
+  if (res.networkError)
+    return unreachable("googlePlay", res, "playdeveloperreporting.googleapis.com");
+  if (res.ok) return { ok: true, store: "googlePlay", status: res.status, hint: null };
+  const body = await readBody(res);
+  return {
+    ok: false,
+    store: "googlePlay",
+    status: res.status,
+    hint: playHint(res.status, body, serviceAccount.project_id),
+  };
+}
+
+export function parseArgs(argv) {
+  const opts = {};
+  const take = (i, flag) => {
+    const v = argv[i + 1];
+    if (v === undefined || v.startsWith("--")) throw new UsageError(`${flag} needs a value`);
+    return v;
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--asc" || a === "--play") {
+      if (opts.mode) throw new UsageError("pass exactly one of --asc and --play");
+      opts.mode = a.slice(2);
+    } else if (a === "--key-id") opts.keyId = take(i++, a);
+    else if (a === "--issuer-id") opts.issuerId = take(i++, a);
+    else if (a === "--p8") opts.p8 = take(i++, a);
+    else if (a === "--service-account") opts.serviceAccount = take(i++, a);
+    else throw new UsageError(`unknown argument: ${a}`);
+  }
+  if (!opts.mode) throw new UsageError("pass --asc or --play");
+  if (opts.mode === "asc" && !(opts.keyId && opts.issuerId && opts.p8)) {
+    throw new UsageError("--asc needs --key-id, --issuer-id and --p8");
+  }
+  if (opts.mode === "play" && !opts.serviceAccount)
+    throw new UsageError("--play needs --service-account");
+  return opts;
+}
+
+const USAGE =
+  "usage: probe-store-key.mjs --asc --key-id <id> --issuer-id <id> --p8 <path>\n" +
+  "       probe-store-key.mjs --play --service-account <path>\n";
+
+export async function main(
+  argv,
+  { fetchImpl = globalThis.fetch, out = process.stdout, err = process.stderr } = {},
+) {
+  let result;
+  try {
+    const opts = parseArgs(argv);
+    if (opts.mode === "asc") {
+      const privateKey = readKeyFile(opts.p8, "App Store Connect private key");
+      try {
+        createPrivateKey(privateKey);
+      } catch {
+        throw new UsageError("the .p8 file does not hold a readable private key");
+      }
+      result = await probeAsc({
+        keyId: opts.keyId,
+        issuerId: opts.issuerId,
+        privateKey,
+        fetchImpl,
+      });
+    } else {
+      const serviceAccount = parseServiceAccount(
+        readKeyFile(opts.serviceAccount, "service-account"),
+      );
+      try {
+        createPrivateKey(serviceAccount.private_key);
+      } catch {
+        throw new UsageError("the service-account private_key is not a readable private key");
+      }
+      result = await probePlay({ serviceAccount, fetchImpl });
+    }
+  } catch (e) {
+    if (e instanceof UsageError) {
+      err.write(`probe-store-key: ${e.message}\n${USAGE}`);
+      return 2;
+    }
+    throw e;
+  }
+  out.write(`${JSON.stringify(result)}\n`);
+  return result.ok ? 0 : 1;
+}
+
+function invokedDirectly() {
+  if (!process.argv[1]) return false;
+  try {
+    return fileURLToPath(import.meta.url) === realpathSync(process.argv[1]);
+  } catch {
+    return false;
+  }
+}
+
+if (invokedDirectly()) {
+  main(process.argv.slice(2)).then(
+    (code) => {
+      process.exitCode = code;
+    },
+    () => {
+      process.stderr.write("probe-store-key: unexpected failure\n");
+      process.exitCode = 1;
+    },
+  );
+}

package/pipeline/scripts/write-store-config.mjs

@@ -0,0 +1,293 @@
+#!/usr/bin/env node
+/**
+ * @file write-store-config.mjs  -  tell the toolkit's store_* tools where the keys are.
+ *
+ * The multi-agent-toolkit MCP server reads App Store Connect and Google Play
+ * credentials from the Keychain through a reference file that names Keychain
+ * services and holds no secret:
+ *
+ *   {"appStoreConnect": {"keyIdService", "issuerIdService", "privateKeyService"},
+ *    "googlePlay":      {"serviceAccountService"}}
+ *
+ * This writes that file from the pipeline's own keychainMapping, so the two
+ * never name different items. Each service name is the mapping value, else the
+ * standard `${USER}_...` name. A store is written only when every one of its
+ * items exists; existence is asked through `credential-store.sh probe`, which
+ * sends the value to /dev/null, so no secret passes through this process.
+ * Top-level keys other than the two stores are preserved.
+ *
+ * Paths: preferences at MULTI_AGENT_PREFS or ~/.claude/multi-agent-preferences.json
+ * (the default credential-store.sh uses); the reference file at
+ * MCP_TOOLKIT_STORE_CONFIG or ~/.config/multi-agent-toolkit/store.json. The
+ * file is written 0600 through a temp file and a rename, its directory 0700
+ * when this creates it.
+ *
+ * Usage:
+ *   write-store-config.mjs           write the file, print one JSON line
+ *   write-store-config.mjs --check   compare only; exit 0 current, 1 missing or stale
+ *
+ * Exit: 0 written / current, 1 stale (--check) or credential backend unavailable,
+ * 2 usage error.
+ */
+
+import { spawnSync } from "node:child_process";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const SERVICE_NAME = /^[A-Za-z0-9_.@-]{1,200}$/;
+
+export const STORES = Object.freeze({
+  appStoreConnect: [
+    {
+      logical: "appstore_connect_key_id",
+      field: "keyIdService",
+      standard: "AppStoreConnect_Key_Id",
+    },
+    {
+      logical: "appstore_connect_issuer_id",
+      field: "issuerIdService",
+      standard: "AppStoreConnect_Issuer_Id",
+    },
+    {
+      logical: "appstore_connect_private_key",
+      field: "privateKeyService",
+      standard: "AppStoreConnect_Private_Key",
+    },
+  ],
+  googlePlay: [
+    { logical: "google_play", field: "serviceAccountService", standard: "GooglePlay_Access_Json" },
+  ],
+});
+
+export const STORE_LOGICAL_KEYS = Object.freeze(
+  Object.values(STORES).flatMap((items) => items.map((i) => i.logical)),
+);
+
+const expandHome = (p) =>
+  p === "~" ? homedir() : p.startsWith("~/") ? join(homedir(), p.slice(2)) : p;
+
+export function prefsPath(env = process.env) {
+  return env.MULTI_AGENT_PREFS || join(homedir(), ".claude", "multi-agent-preferences.json");
+}
+
+export function storeConfigPath(env = process.env) {
+  return expandHome(
+    env.MCP_TOOLKIT_STORE_CONFIG || join(homedir(), ".config", "multi-agent-toolkit", "store.json"),
+  );
+}
+
+export function readMapping(path) {
+  try {
+    const prefs = JSON.parse(readFileSync(path, "utf8"));
+    const km = prefs?.global?.keychainMapping;
+    return km && typeof km === "object" ? km : {};
+  } catch {
+    return {};
+  }
+}
+
+export function serviceName(mapping, item, user) {
+  const mapped = mapping[item.logical];
+  if (typeof mapped === "string" && mapped.trim()) return mapped.trim();
+  return user ? `${user}_${item.standard}` : null;
+}
+
+/**
+ * Presence through credential-store.sh probe, passed the resolved service name
+ * so a mapping cannot redirect it. `locked` counts as present: the item is
+ * there, and the toolkit reports the lock itself when it reads. The probe finds
+ * an item by label or by service while the toolkit reads by service; items that
+ * credential-store.sh writes carry both, so the two agree for every key setup
+ * stores. A hand-made item with only a label passes here and is reported by the
+ * toolkit as missing.
+ *
+ * @returns {"present"|"missing"|"unavailable"}
+ */
+export function probeWith(storeScript) {
+  return (service) => {
+    const r = spawnSync("bash", [storeScript, "probe", service], {
+      stdio: ["ignore", "pipe", "ignore"],
+      encoding: "utf8",
+      timeout: 15000,
+    });
+    if (r.status === 0 || r.status === 5) return "present";
+    if (r.status === 1) return "missing";
+    return "unavailable";
+  };
+}
+
+/**
+ * What the reference file should say, and why each store is in or out.
+ *
+ * @param {{mapping: object, user: string, probe: (service: string) => string}} input
+ */
+export function desiredConfig({ mapping, user, probe }) {
+  const config = {};
+  const stores = {};
+  let unavailable = false;
+  for (const [store, items] of Object.entries(STORES)) {
+    const entry = {};
+    const missing = [];
+    for (const item of items) {
+      const primary = serviceName(mapping, item, user);
+      // Unmapped, credential-store.sh stores a key under its bare logical name,
+      // so that name is tried after the standard one.
+      const candidates = [primary, ...(mapping[item.logical] ? [] : [item.logical])].filter(
+        (n) => n && SERVICE_NAME.test(n),
+      );
+      if (!candidates.length) {
+        missing.push(`${item.logical} (no usable service name)`);
+        continue;
+      }
+      let name = candidates[0];
+      let state = probe(name);
+      for (const alt of candidates.slice(1)) {
+        if (state === "present") break;
+        const altState = probe(alt);
+        if (altState === "present") {
+          name = alt;
+          state = altState;
+        }
+      }
+      if (state === "unavailable") unavailable = true;
+      if (state !== "present") missing.push(item.logical);
+      entry[item.field] = name;
+    }
+    if (missing.length) {
+      stores[store] = { included: false, missing };
+    } else {
+      config[store] = entry;
+      stores[store] = { included: true };
+    }
+  }
+  return { config, stores, unavailable };
+}
+
+export function readExisting(path) {
+  if (!existsSync(path)) return { exists: false, config: null };
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return {
+      exists: true,
+      config: parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null,
+    };
+  } catch {
+    return { exists: true, config: null };
+  }
+}
+
+export function merged(existing, desired) {
+  const out = { ...(existing || {}) };
+  for (const store of Object.keys(STORES)) {
+    if (desired[store]) out[store] = desired[store];
+    else delete out[store];
+  }
+  return out;
+}
+
+const canonical = (o) =>
+  JSON.stringify(o, (_, v) =>
+    v && typeof v === "object" && !Array.isArray(v)
+      ? Object.fromEntries(
+          Object.keys(v)
+            .sort()
+            .map((k) => [k, v[k]]),
+        )
+      : v,
+  );
+
+export function sameStores(a, b) {
+  return Object.keys(STORES).every((s) => canonical(a?.[s] ?? null) === canonical(b?.[s] ?? null));
+}
+
+export function writeAtomic(path, config) {
+  const dir = dirname(path);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+  }
+  const tmp = join(dir, `.store.json.${process.pid}.${Date.now()}.tmp`);
+  try {
+    writeFileSync(tmp, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+    chmodSync(tmp, 0o600);
+    renameSync(tmp, path);
+  } catch (e) {
+    rmSync(tmp, { force: true });
+    throw e;
+  }
+}
+
+export function run(
+  argv,
+  { env = process.env, probe, out = process.stdout, err = process.stderr } = {},
+) {
+  const check = argv.includes("--check");
+  const unknown = argv.filter((a) => a !== "--check");
+  if (unknown.length) {
+    err.write(`usage: write-store-config.mjs [--check]\n`);
+    return 2;
+  }
+  const storeScript = env.CRED_STORE || join(HERE, "..", "lib", "credential-store.sh");
+  const path = storeConfigPath(env);
+  const mapping = readMapping(prefsPath(env));
+  const desired = desiredConfig({
+    mapping,
+    user: env.USER || "",
+    probe: probe || probeWith(storeScript),
+  });
+  const existing = readExisting(path);
+  const current = existing.config !== null && sameStores(existing.config, desired.config);
+  const wanted = Object.keys(desired.config).length > 0;
+  const matches = existing.exists
+    ? current && (wanted || Object.keys(existing.config).length > 0)
+    : !wanted;
+
+  const summary = { path, stores: desired.stores };
+  if (desired.unavailable) {
+    out.write(`${JSON.stringify({ ...summary, error: "credential store unavailable" })}\n`);
+    return 1;
+  }
+  if (check) {
+    const state = matches ? "current" : existing.exists ? "stale" : "missing";
+    out.write(`${JSON.stringify({ ...summary, state })}\n`);
+    return matches ? 0 : 1;
+  }
+  if (matches) {
+    out.write(`${JSON.stringify({ ...summary, written: false, state: "current" })}\n`);
+    return 0;
+  }
+  const next = merged(existing.config, desired.config);
+  if (Object.keys(next).length === 0) {
+    rmSync(path, { force: true });
+    out.write(`${JSON.stringify({ ...summary, written: false, removed: existing.exists })}\n`);
+    return 0;
+  }
+  writeAtomic(path, next);
+  out.write(`${JSON.stringify({ ...summary, written: true })}\n`);
+  return 0;
+}
+
+function invokedDirectly() {
+  if (!process.argv[1]) return false;
+  try {
+    return fileURLToPath(import.meta.url) === realpathSync(process.argv[1]);
+  } catch {
+    return false;
+  }
+}
+
+if (invokedDirectly()) {
+  process.exitCode = run(process.argv.slice(2));
+}

package/pipeline/skills/.skill-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-09-27T10:26:38Z",
+  "generatedAt": "2026-09-29T06:46:22Z",
   "skillCount": 218,
   "entries": [
     {
@@ -9,7 +9,7 @@
     },
     {
       "path": "shared/core/google-play-compliance/SKILL.md",
-      "sha256": "3d15929685bb84bcdd2fee621176b9c12686a2f5152bd46ed19b959d7e851cc0"
+      "sha256": "3089e8c5f99c1ec7c1358394c398335ccb5ebc20ca05d60d870127da4592de34"
     },
     {
       "path": "shared/core/multi-agent-analysis-jira/SKILL.md",
@@ -201,7 +201,7 @@
     },
     {
       "path": "shared/core/multi-agent-setup/SKILL.md",
-      "sha256": "d57769a5857c6ed06f1c2c9995da77901af14c5ae493c8ec8c454b977c5666e9"
+      "sha256": "f73388e0a64ba8a1606e3364441b078f3df6f7e99e589fb9bc8b93269a2733b2"
     },
     {
       "path": "shared/core/multi-agent-stack/SKILL.md",
@@ -217,7 +217,7 @@
     },
     {
       "path": "shared/core/multi-agent-store-ready/SKILL.md",
-      "sha256": "86838f9b922cdaebfebdc019aab7861e8e0d436620e43a715b3e3da1ddfc804b"
+      "sha256": "514cb5b80f9584da035f6ac23681b42c765fdced25d704f8e36b6cc079b8093d"
     },
     {
       "path": "shared/core/multi-agent-sync/SKILL.md",

package/pipeline/skills/shared/core/google-play-compliance/SKILL.md

@@ -341,7 +341,7 @@ The appended section is structured:
 
 - **Policy thresholds change yearly.** Target API level (currently 34) advances each August for new apps / November for updates. When a new Android version ships, update Rule #1 `target-api-level` with the new threshold.
 - **Not a substitute for Play Console pre-launch report.** This skill catches static issues (manifest, signing, size, debug tools). Dynamic issues (crashes, ANRs, security vulnerabilities) require Play Console's own pre-launch testing on real devices.
-- **Data Safety form audit is partial.** Rule #14 flags manifest permissions that commonly trigger form updates, but the actual form lives in Play Console and can't be fully cross-checked without the Play Developer API.
+- **Data Safety form audit is partial.** Rule #14 flags manifest permissions that commonly trigger form updates, but the declared answers live in Play Console and cannot be cross-checked from here. The Android Publisher API has no Data Safety read: its only operation, `applications.dataSafety`, writes the declaration. With `google_play` onboarded, `store_search` / `store_call` reach the rest of the Android Publisher and Play Developer Reporting APIs (tracks, bundles, vitals), but the gap for Data Safety stays.
 
 ## Version history