apphx 1.1.0 → 2.0.0

package/dist/apple-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"apple-types.js","names":[],"sources":["../src/apple-types.ts"],"sourcesContent":["import { z } from 'zod';\n\nconst text = z.string().min(1);\nconst effect = z.strictObject({ id: text.optional() });\n\nexport const AppleReceiptSchema = z.strictObject({\n  identity: z.strictObject({ appId: text, bundleId: text, version: text, buildNumber: text }).optional(),\n  pending: z.strictObject({ key: text, path: text.optional(), method: z.enum(['POST', 'PATCH', 'PUT']).optional(), startedAt: z.iso.datetime().optional() }).nullable().optional(),\n  effects: z.record(z.string(), effect).optional(),\n  lastEffect: z.strictObject({ key: text, id: text.optional(), reconciled: z.boolean().optional(), completedAt: z.iso.datetime().optional() }).optional(),\n  upload: z.strictObject({ status: z.enum(['intent', 'delivered', 'reconciled']), startedAt: z.iso.datetime().optional() }).optional(),\n  phase: z.enum(['processing', 'submitted']).optional(),\n  versionId: text.optional(),\n  buildId: text.optional(),\n  submissionId: text.optional(),\n  assetParts: z.record(z.string(), z.number().int().nonnegative().safe()).optional(),\n});\n\nexport interface AppleReceipt extends z.infer<typeof AppleReceiptSchema> {}\n\nexport interface ApplePollResult {\n  status: 'waiting' | 'approved' | 'rejected';\n  detail: string;\n  distributionReady?: boolean;\n  available?: boolean;\n}\n"],"mappings":";;AAEA,MAAM,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC7B,MAAM,SAAS,EAAE,aAAa,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;AAErD,MAAa,qBAAqB,EAAE,aAAa;CAC/C,UAAU,EAAE,aAAa;EAAE,OAAO;EAAM,UAAU;EAAM,SAAS;EAAM,aAAa;CAAK,CAAC,CAAC,CAAC,SAAS;CACrG,SAAS,EAAE,aAAa;EAAE,KAAK;EAAM,MAAM,KAAK,SAAS;EAAG,QAAQ,EAAE,KAAK;GAAC;GAAQ;GAAS;EAAK,CAAC,CAAC,CAAC,SAAS;EAAG,WAAW,EAAE,IAAI,SAAS,CAAC,CAAC,SAAS;CAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CAC/K,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC,SAAS;CAC/C,YAAY,EAAE,aAAa;EAAE,KAAK;EAAM,IAAI,KAAK,SAAS;EAAG,YAAY,EAAE,QAAQ,CAAC,CAAC,SAAS;EAAG,aAAa,EAAE,IAAI,SAAS,CAAC,CAAC,SAAS;CAAE,CAAC,CAAC,CAAC,SAAS;CACtJ,QAAQ,EAAE,aAAa;EAAE,QAAQ,EAAE,KAAK;GAAC;GAAU;GAAa;EAAY,CAAC;EAAG,WAAW,EAAE,IAAI,SAAS,CAAC,CAAC,SAAS;CAAE,CAAC,CAAC,CAAC,SAAS;CACnI,OAAO,EAAE,KAAK,CAAC,cAAc,WAAW,CAAC,CAAC,CAAC,SAAS;CACpD,WAAW,KAAK,SAAS;CACzB,SAAS,KAAK,SAAS;CACvB,cAAc,KAAK,SAAS;CAC5B,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;AACnF,CAAC"}
+{"version":3,"file":"apple-types.js","names":[],"sources":["../src/apple-types.ts"],"sourcesContent":["import { z } from 'zod';\n\nconst text = z.string().min(1);\nconst effect = z.strictObject({ id: text.optional() });\n\nexport const AppleReceiptSchema = z.strictObject({\n  identity: z.strictObject({ appId: text, bundleId: text, version: text, buildNumber: text }).optional(),\n  pending: z.strictObject({ key: text, path: text.optional(), method: z.enum(['POST', 'PATCH', 'PUT']).optional(), startedAt: z.iso.datetime().optional() }).nullable().optional(),\n  effects: z.record(z.string(), effect).optional(),\n  lastEffect: z.strictObject({ key: text, id: text.optional(), reconciled: z.boolean().optional(), completedAt: z.iso.datetime().optional() }).optional(),\n  upload: z.strictObject({ status: z.enum(['intent', 'delivered', 'reconciled']), startedAt: z.iso.datetime().optional() }).optional(),\n  phase: z.enum(['processing', 'submitted']).optional(),\n  versionId: text.optional(),\n  buildId: text.optional(),\n  submissionId: text.optional(),\n  assetParts: z.record(z.string(), z.number().int().nonnegative().safe()).optional(),\n});\n\nexport interface AppleReceipt extends z.infer<typeof AppleReceiptSchema> {}\n\n"],"mappings":";;AAEA,MAAM,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC7B,MAAM,SAAS,EAAE,aAAa,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;AAErD,MAAa,qBAAqB,EAAE,aAAa;CAC/C,UAAU,EAAE,aAAa;EAAE,OAAO;EAAM,UAAU;EAAM,SAAS;EAAM,aAAa;CAAK,CAAC,CAAC,CAAC,SAAS;CACrG,SAAS,EAAE,aAAa;EAAE,KAAK;EAAM,MAAM,KAAK,SAAS;EAAG,QAAQ,EAAE,KAAK;GAAC;GAAQ;GAAS;EAAK,CAAC,CAAC,CAAC,SAAS;EAAG,WAAW,EAAE,IAAI,SAAS,CAAC,CAAC,SAAS;CAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CAC/K,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC,SAAS;CAC/C,YAAY,EAAE,aAAa;EAAE,KAAK;EAAM,IAAI,KAAK,SAAS;EAAG,YAAY,EAAE,QAAQ,CAAC,CAAC,SAAS;EAAG,aAAa,EAAE,IAAI,SAAS,CAAC,CAAC,SAAS;CAAE,CAAC,CAAC,CAAC,SAAS;CACtJ,QAAQ,EAAE,aAAa;EAAE,QAAQ,EAAE,KAAK;GAAC;GAAU;GAAa;EAAY,CAAC;EAAG,WAAW,EAAE,IAAI,SAAS,CAAC,CAAC,SAAS;CAAE,CAAC,CAAC,CAAC,SAAS;CACnI,OAAO,EAAE,KAAK,CAAC,cAAc,WAAW,CAAC,CAAC,CAAC,SAAS;CACpD,WAAW,KAAK,SAAS;CACzB,SAAS,KAAK,SAAS;CACvB,cAAc,KAAK,SAAS;CAC5B,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;AACnF,CAAC"}

package/dist/cli.js

@@ -1,17 +1,23 @@
 #!/usr/bin/env node
-import { toError } from "./schemas.js";
+import { validateMyGoCommand } from "./mygo-build.js";
+import { FrameworkSchema, PackageTargetSchema, PlatformSchema, toError, validateJobConfig } from "./schemas.js";
+import { canonicalPath, expandArgv, loadConfig, loadJSON, normalizeIsolationPaths, validateProjectSource } from "./config.js";
 import { executionEnvironment, run } from "./process.js";
-import { appleDoctor, validateAppleSpec } from "./apple.js";
-import { loadConfig, loadJSON } from "./config.js";
+import { closestOwnedGoWorkspace } from "./go-dependencies.js";
 import { Store } from "./store.js";
+import { prepareIsolatedCommand, removeConfinedPath } from "./isolation.js";
+import { assertProject, doctorCommands } from "./project-profiles.js";
+import { invalidateVerification, verificationConfigChanged } from "./proof.js";
 import { abandonTurn, completeTurn, nextTurn } from "./runner.js";
 import { runStep } from "./scheduler.js";
 import { hosts, inspectIntegration, installIntegration, uninstallIntegration, updateIntegration } from "./integrations.js";
 import { MAX_INPUT_BYTES, parseRequirement, readInputFile } from "./requirements.js";
 import { scanInbox, submitRequirement } from "./inbox.js";
 import { dispatchRemote } from "./remote.js";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
 import { dirname, join, resolve } from "node:path";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 // src/cli.ts
@@ -20,7 +26,10 @@ const print = (value) => console.log(JSON.stringify(value, null, 2));
 const view = (job) => ({
 	id: job.id,
 	product: job.spec.id,
-	version: job.spec.apple?.version ?? "1.0.0",
+	framework: job.spec.framework,
+	platform: job.spec.platform,
+	channel: job.spec.channel,
+	version: job.spec.version,
 	stage: job.stage,
 	status: job.status,
 	hostTurns: job.hostTurns,
@@ -41,10 +50,38 @@ function outcome(job) {
 	print(view(job));
 	if (job.status === "blocked" || job.status === "failed") process.exitCode = 2;
 }
-async function probe(argv, config) {
+async function probe(argv, config, context) {
+	let temporary;
+	let isolated;
 	try {
-		const result = await run(argv, {
-			env: executionEnvironment(config),
+		const env = context?.env ?? executionEnvironment(config);
+		const expanded = expandArgv(argv, env);
+		validateMyGoCommand(config, expanded);
+		if (config.isolation) {
+			if (!config.allowLocalExecution) return {
+				available: false,
+				detail: "Owner must enable local execution before isolated probes run"
+			};
+			temporary = mkdtempSync(join(tmpdir(), "apphx-doctor-"));
+			const scoped = {
+				...config,
+				isolation: {
+					...config.isolation,
+					readOnlyPaths: [...config.isolation.readOnlyPaths, ...context?.sourceRoot ? [canonicalPath(context.sourceRoot)] : []]
+				}
+			};
+			normalizeIsolationPaths(scoped);
+			isolated = prepareIsolatedCommand(expanded, {
+				config: scoped,
+				workspace: temporary,
+				cwd: context?.cwd ?? temporary,
+				env,
+				scratchParent: temporary
+			});
+		}
+		const result = await run(isolated?.argv ?? expanded, {
+			cwd: context?.cwd ?? temporary,
+			env: isolated?.env ?? env,
 			timeoutMs: 3e4
 		});
 		return {
@@ -56,7 +93,195 @@ async function probe(argv, config) {
 			available: false,
 			detail: toError(error).message
 		};
+	} finally {
+		isolated?.cleanup();
+		if (temporary) removeConfinedPath(temporary, temporary);
+	}
+}
+const frameworks = FrameworkSchema.options;
+const packageTargets = PackageTargetSchema.options;
+function initialConfig(framework, platform, target) {
+	if (framework === "mygo" !== (platform === "macos")) throw new Error(`${framework} does not support ${platform}`);
+	if (framework === "android-java" && platform !== "android" || framework === "swift" && platform !== "ios") throw new Error(`${framework} does not support ${platform}`);
+	if (!(platform === "macos" ? ["app", "dmg"] : platform === "ios" ? ["simulator", "ipa"] : ["apk", "aab"]).includes(target)) throw new Error(`${target} does not match platform ${platform}`);
+	const template = JSON.parse(readFileSync(join(packageRoot, "examples", `${framework}.factory.json`), "utf8"));
+	template.packageTarget = target;
+	if (framework === "mygo") template.packaging = {
+		provider: "local",
+		commands: [[
+			"go",
+			"tool",
+			"mygo",
+			"build",
+			"-platform",
+			"darwin/arm64",
+			"-sign",
+			"-",
+			"-skip-notarize",
+			...target === "app" ? ["-skip-dmg"] : [],
+			"-o",
+			"build"
+		]],
+		artifactPath: target === "app" ? "build/darwin-arm64/MyGo App.app" : "build/darwin-arm64/MyGo App 0.1.0.dmg"
+	};
+	else if (framework === "flutter") {
+		template.executionEnv = platform === "ios" ? ["IOS_DEVICE_ID"] : ["ANDROID_DEVICE_ID"];
+		template.verification = {
+			prerequisites: platform === "ios" ? [["xcodebuild", "-version"]] : [["java", "-version"], ["adb", "version"]],
+			checks: [[
+				"flutter",
+				"analyze",
+				"--fatal-infos"
+			], ["flutter", "test"]],
+			runtime: [[
+				"flutter",
+				"drive",
+				"--driver",
+				"test_driver/integration_test.dart",
+				"--target",
+				"integration_test/app_test.dart",
+				"-d",
+				platform === "ios" ? "${IOS_DEVICE_ID}" : "${ANDROID_DEVICE_ID}",
+				"--no-pub"
+			]]
+		};
+	} else if (framework === "expo") {
+		const device = platform === "ios" ? "IOS_DEVICE_ID" : "ANDROID_DEVICE_ID";
+		const profile = target === "simulator" ? "simulator" : target === "apk" ? "apk" : "production";
+		const output = target === "simulator" ? "build/simulator.tar.gz" : `build/app.${target}`;
+		template.executionEnv = [device, ...platform === "android" ? ["ANDROID_HOME"] : []];
+		template.verification = {
+			prerequisites: [["node", "--version"], ["eas", "--version"]],
+			checks: [[
+				"npm",
+				"run",
+				"lint"
+			], [
+				"npm",
+				"test",
+				"--",
+				"--runInBand"
+			]],
+			runtime: [[
+				"npm",
+				"run",
+				"test:e2e",
+				"--",
+				"--platform",
+				platform,
+				"--device",
+				"${" + device + "}"
+			]]
+		};
+		template.packaging = {
+			provider: "local",
+			commands: [[
+				"eas",
+				"build",
+				"--platform",
+				platform,
+				"--profile",
+				profile,
+				"--local",
+				"--non-interactive",
+				"--output",
+				output
+			], ...target === "simulator" ? [[
+				"tar",
+				"-xzf",
+				output,
+				"-C",
+				"build"
+			]] : []],
+			artifactPath: target === "simulator" ? "build/App.app" : output
+		};
+	} else if (platform === "ios") {
+		const base = [
+			"xcodebuild",
+			...framework === "swift" ? ["-project", "App.xcodeproj"] : ["-workspace", `${framework === "swift" ? "." : framework === "uni-app" ? "native/ios" : "ios"}/App.xcworkspace`],
+			"-scheme",
+			"App"
+		];
+		template.executionEnv = ["IOS_DEVICE_ID"];
+		template.verification = {
+			prerequisites: [["xcodebuild", "-version"], ...framework === "swift" ? [] : [["node", "--version"], ["npm", "--version"]]],
+			checks: framework === "swift" ? [[
+				...base,
+				"build-for-testing",
+				"-destination",
+				"generic/platform=iOS Simulator",
+				"-derivedDataPath",
+				"build/DerivedData"
+			]] : [[
+				"npm",
+				"run",
+				"lint"
+			], [
+				"npm",
+				"test",
+				"--",
+				"--runInBand"
+			]],
+			runtime: framework === "swift" ? [[
+				...base,
+				"test",
+				"-destination",
+				"id=${IOS_DEVICE_ID}",
+				"-derivedDataPath",
+				"build/DerivedData"
+			]] : [[
+				"npm",
+				"run",
+				"test:e2e",
+				"--",
+				"--platform",
+				"ios",
+				"--device",
+				"${IOS_DEVICE_ID}"
+			]]
+		};
+		template.packaging = target === "simulator" ? {
+			commands: [[
+				...base,
+				"build",
+				"-configuration",
+				"Debug",
+				"-destination",
+				"generic/platform=iOS Simulator",
+				"-derivedDataPath",
+				"build/DerivedData"
+			]],
+			artifactPath: "build/DerivedData/Build/Products/Debug-iphonesimulator/App.app",
+			provider: "local"
+		} : {
+			commands: [[
+				...base,
+				"archive",
+				"-configuration",
+				"Release",
+				"-destination",
+				"generic/platform=iOS",
+				"-archivePath",
+				"build/App.xcarchive"
+			], [
+				"xcodebuild",
+				"-exportArchive",
+				"-archivePath",
+				"build/App.xcarchive",
+				"-exportPath",
+				"build/export",
+				"-exportOptionsPlist",
+				"ExportOptions.plist"
+			]],
+			artifactPath: "build/export/App.ipa",
+			provider: "local"
+		};
+	} else if (target === "apk") {
+		const packaging = template.packaging;
+		packaging.commands = packaging.commands.map((argv) => argv.map((arg) => arg === ":app:bundleRelease" ? ":app:assembleRelease" : arg));
+		packaging.artifactPath = packaging.artifactPath.replace("bundle/release/app-release.aab", "apk/release/app-release.apk");
 	}
+	return template;
 }
 const help = `apphx <command> [--config factory.json] [--build-only]
   hosts                         List supported agent hosts and activation commands
@@ -66,28 +291,33 @@ const help = `apphx <command> [--config factory.json] [--build-only]
     --project <directory>       Select the project (default: current directory)
     --global                    Use the host's user-level skill directory instead
   doctor --host <host>           Check installed workflow files; does not run the agent
-  init [--allow-local-execution] Create factory.json without overwriting it
-  doctor                        Check local build tools and execution permissions
+  init [--allow-local-execution] Create owner-editable factory.json; default Flutter/iOS
+    --framework <stack>         flutter|android-java|swift|react-native|expo|uni-app|mygo
+    --platform <platform>       ios|android|macos (mygo defaults macos; android-java android)
+    --package-target <target>   simulator|ipa|apk|aab|app|dmg (MyGo app; Expo iOS ipa)
+  doctor [spec.json]            Check configured prerequisites and optional stack tools
   enqueue <spec.json|->          Persist requirements and return a task ID
   next <id>                     Resume a host turn or show the next deterministic action
   complete <id> <turn> [json|-]   Record research/review, or finish the host's build turn
   abandon <id> <turn>            Abandon a host turn without resetting its budget
-  step <id>                     Execute one verification, packaging or Apple stage
+  step <id>                     Execute one obfuscation, verification or packaging stage
   status [id]                   Read durable task state as JSON
   events <id>                   Read task transitions and evidence
-  retry <id>                    Resume stopped work; preserve budgets and permissions
+  retry <id>                    Resume stopped work; preserve budgets and proofs
   submit <spec.json|->           Write requirements to the configured inbox
   scan [--observe]              Validate or ingest inbox files; never start an agent
   inbox                         Read durable intake results
   reconcile-intake <id> <json|-> Restore a legacy request identity from original input
-  authorize <id> --submit [--release]  Explicitly grant publication permission
-  feedback <id> <file>           Resume using actual App Review rejection feedback
   remote <command>              Call an installed Mac CLI over SSH (build-only)
+  obfuscator <project>          Run the bundled deterministic obfuscator on a project copy
+    --config <file>             Obfuscator options as JSON (required)
+    --framework <stack>         flutter|android-java|swift|react-native|expo|uni-app|mygo
+    --seed <text>               Determinism seed
   --version                     Print the installed package version
 
 Your agent supplies the model, session, tools and native delegation.
 No coding-agent subprocess or autonomous daemon is started by this CLI.
-Only verified local artifacts reach built; uploads require separate authorization.`;
+Only verified local artifacts reach built. Store submission and review are manual human work outside this tool.`;
 async function main() {
 	const { values, positionals, tokens } = parseArgs({
 		allowPositionals: true,
@@ -105,9 +335,11 @@ async function main() {
 			global: { type: "boolean" },
 			host: { type: "string" },
 			"allow-local-execution": { type: "boolean" },
+			framework: { type: "string" },
+			seed: { type: "string" },
+			platform: { type: "string" },
+			"package-target": { type: "string" },
 			observe: { type: "boolean" },
-			submit: { type: "boolean" },
-			release: { type: "boolean" },
 			version: {
 				type: "boolean",
 				short: "v"
@@ -133,7 +365,13 @@ async function main() {
 		install: ["project", "global"],
 		update: ["project", "global"],
 		uninstall: ["project", "global"],
-		init: ["config", "allow-local-execution"],
+		init: [
+			"config",
+			"allow-local-execution",
+			"framework",
+			"platform",
+			"package-target"
+		],
 		doctor: [
 			"config",
 			"build-only",
@@ -157,14 +395,12 @@ async function main() {
 		],
 		inbox: ["config", "build-only"],
 		"reconcile-intake": ["config", "build-only"],
-		authorize: [
+		remote: ["config", "observe"],
+		obfuscator: [
 			"config",
-			"build-only",
-			"submit",
-			"release"
-		],
-		feedback: ["config", "build-only"],
-		remote: ["config", "observe"]
+			"framework",
+			"seed"
+		]
 	};
 	if (!(command in flags)) throw new Error(`Unknown command ${command}; run apphx --help`);
 	for (const token of tokens) if (token.kind === "option" && !flags[command].includes(token.name)) throw new Error(`${command} does not accept --${token.name}`);
@@ -175,6 +411,23 @@ async function main() {
 		project: values.project,
 		global: values.global
 	};
+	if (command === "obfuscator") {
+		arity(args, 1, 1, "obfuscator <project> --config <file> [--framework <stack>] [--seed <text>]");
+		const bundled = join(packageRoot, "dist", "vendor", "obfuscator", "dist", "cli.js");
+		if (!existsSync(bundled)) throw new Error(`Bundled obfuscator is missing at ${bundled}; reinstall the apphx package`);
+		const forward = [
+			bundled,
+			"--project",
+			resolve(args[0])
+		];
+		if (tokens.some((token) => token.kind === "option" && token.name === "config")) forward.push("--config", resolve(values.config));
+		if (values.framework !== void 0) forward.push("--framework", values.framework);
+		if (values.seed !== void 0) forward.push("--seed", values.seed);
+		const result = spawnSync(process.execPath, forward, { stdio: "inherit" });
+		if (result.error) throw result.error;
+		process.exitCode = result.status ?? 1;
+		return;
+	}
 	if (command === "hosts") {
 		arity(args, 0, 0, "hosts");
 		print(hosts);
@@ -194,8 +447,13 @@ async function main() {
 	}
 	if (command === "doctor" && (values.project || values.global)) throw new Error("--project and --global require doctor --host <host>");
 	if (command === "init") {
-		arity(args, 0, 0, "init [--config <file>] [--allow-local-execution]");
-		const template = JSON.parse(readFileSync(join(packageRoot, "examples", "factory.json"), "utf8"));
+		arity(args, 0, 0, "init [--framework <stack>] [--platform ios|android|macos] [--package-target simulator|ipa|apk|aab|app|dmg] [--config <file>] [--allow-local-execution]");
+		const framework = values.framework ?? "flutter";
+		if (!frameworks.includes(framework)) throw new Error(`Unknown framework ${framework}; choose ${frameworks.join(", ")}`);
+		const platform = PlatformSchema.parse(values.platform ?? (framework === "mygo" ? "macos" : framework === "android-java" ? "android" : "ios"));
+		const target = values["package-target"] ?? (platform === "macos" ? "app" : platform === "ios" ? framework === "expo" ? "ipa" : "simulator" : "apk");
+		if (!packageTargets.includes(target)) throw new Error(`Unknown package target ${target}; choose ${packageTargets.join(", ")}`);
+		const template = initialConfig(framework, platform, target);
 		if (values["allow-local-execution"]) template.allowLocalExecution = true;
 		mkdirSync(dirname(resolve(configPath)), { recursive: true });
 		writeFileSync(configPath, `${JSON.stringify(template, null, 2)}\n`, {
@@ -204,8 +462,11 @@ async function main() {
 		});
 		print({
 			config: resolve(configPath),
+			framework,
+			platform,
+			packageTarget: target,
 			localExecution: template.allowLocalExecution,
-			next: "Configure Flutter/Xcode and IOS_DEVICE_ID, then run apphx doctor --build-only"
+			next: framework === "mygo" ? "Pin MyGo v0.3.0 in go.mod (Go 1.27.1), match app name/version/arch and artifact path, and implement real desktop UI acceptance in cmd/acceptance. Native UI needs no Bun. Local ad-hoc builds only; init creates configuration, not source." : framework === "expo" ? "Configure your existing eas.json production (store IPA/AAB), apk (Android buildType apk), or simulator (ios.simulator true) profile, real device acceptance, and exact app product/output path; no prebuild/eject is requested. Run apphx doctor <spec.json> --build-only." : "Adapt module/scheme, real device acceptance, signing and artifact path to your project; then run apphx doctor <spec.json> --build-only. init creates configuration, not app source."
 		});
 		return;
 	}
@@ -214,58 +475,106 @@ async function main() {
 		return;
 	}
 	const config = loadConfig(configPath);
-	if (buildOnly && (config.allowSubmit || config.allowRelease)) throw new Error("--build-only refuses configurations with upload or release enabled");
-	if (buildOnly && ["authorize", "feedback"].includes(command)) throw new Error("Publication commands are forbidden in --build-only mode");
 	if (command === "submit") {
 		arity(args, 1, 1, "submit <spec.json|->");
 		print(submitRequirement(config, inputJSON(args[0])));
 		return;
 	}
 	if (command === "doctor") {
-		arity(args, 0, 0, "doctor [--build-only]");
-		const flutter = config.toolchain ? join(config.toolchain.flutterSdk, "bin", "flutter") : "flutter";
-		const [flutterCheck, xcode] = await Promise.all([probe([flutter, "--version"], config), probe(["xcodebuild", "-version"], config)]);
+		arity(args, 0, 1, "doctor [spec.json] [--build-only]");
+		const spec = args[0] ? parseRequirement(inputJSON(args[0])).spec : void 0;
+		let prerequisiteContext;
+		if (spec) {
+			validateJobConfig(spec, config);
+			let source;
+			try {
+				source = validateProjectSource(spec, config);
+			} catch (error) {
+				if (spec.framework !== "mygo" || error.code !== "ENOENT") throw error;
+			}
+			const directory = spec.project?.directory ?? ".";
+			const project = source ? resolve(source, directory) : void 0;
+			if (source && project && (spec.framework !== "mygo" || existsSync(project))) {
+				assertProject(project, spec);
+				if (spec.framework === "mygo" || config.isolation) prerequisiteContext = {
+					cwd: project,
+					sourceRoot: source,
+					env: {
+						...executionEnvironment(config),
+						...spec.framework === "mygo" ? {
+							GOWORK: closestOwnedGoWorkspace(source, directory) ?? "off",
+							GOENV: "off",
+							GOTOOLCHAIN: "local",
+							GOFLAGS: "-mod=readonly"
+						} : {}
+					}
+				};
+			}
+		}
+		const commands = spec && config.packaging?.provider !== "cloud" ? doctorCommands(spec.framework, spec.platform) : [];
+		const tools = await Promise.all(commands.map(async ({ name, argv }) => ({
+			name,
+			...await probe(argv[0] === "flutter" && config.toolchain ? [join(config.toolchain.flutterSdk, "bin", "flutter"), ...argv.slice(1)] : argv, config)
+		})));
+		const prerequisites = await Promise.all(config.verification.prerequisites.map(async (argv, index) => ({
+			name: `configured-prerequisite-${index + 1}`,
+			...!config.allowLocalExecution ? {
+				available: false,
+				detail: "Owner must enable allowLocalExecution before configured prerequisite commands run"
+			} : spec?.framework === "mygo" && !prerequisiteContext ? {
+				available: false,
+				detail: "Project-scoped prerequisite cannot be checked yet: select an existing MyGo source app with project.sourceDir and project.directory; doctor does not create source or use the control module"
+			} : await probe(argv, config, prerequisiteContext)
+		})));
 		const environment = executionEnvironment(config);
-		const neededEnv = [...new Set([
+		const configuredCommands = [
 			...config.verification.prerequisites,
 			...config.verification.checks,
-			...config.verification.runtime
-		].flat().flatMap((arg) => [...arg.matchAll(/\$\{([A-Z][A-Z0-9_]*)\}/g)].map((match) => match[1])))];
+			...config.verification.runtime,
+			...config.packaging?.commands ?? []
+		];
+		const neededEnv = [...new Set(configuredCommands.flat().flatMap((arg) => [...arg.matchAll(/\$\{([A-Z][A-Z0-9_]*)\}/g)].map((match) => match[1])))];
 		const checks = [
 			{
 				name: "local-execution-permission",
 				available: config.allowLocalExecution,
 				detail: config.executionWarning ?? "Trusted local commands permitted; host tools remain under the host permission policy"
 			},
-			{
-				name: "flutter",
-				...flutterCheck
-			},
-			{
-				name: "xcode",
-				...xcode
-			},
+			...config.isolation ? [{
+				name: "subprocess-isolation",
+				...await probe(["/usr/bin/true"], config),
+				mode: config.isolation.mode,
+				network: config.isolation.network
+			}] : [],
+			...tools,
+			...prerequisites,
 			...neededEnv.map((name) => ({
 				name,
 				available: Boolean(environment[name]),
 				detail: environment[name] ? "Available in the configured execution environment; value not printed" : `Set ${name} and include its name in executionEnv`
 			}))
 		];
-		if (config.allowSubmit) checks.push(...await appleDoctor());
 		print({
+			framework: spec?.framework ?? null,
+			platform: spec?.platform ?? null,
 			checks,
-			submissionEnabled: config.allowSubmit,
+			note: spec ? "Tool availability is not runtime acceptance; configured checks run in the task workspace during verify" : "No stack assumed; pass spec.json for profile-specific probes and compatibility checks",
 			model: "Provided by your agent host; no separate model authentication is configured here"
 		});
 		if (checks.some((check) => !check.available)) process.exitCode = 2;
 		return;
 	}
+	const queuedRequirement = command === "enqueue" ? (() => {
+		arity(args, 1, 1, "enqueue <spec.json|->");
+		const requirement = parseRequirement(inputJSON(args[0]));
+		validateJobConfig(requirement.spec, config);
+		validateProjectSource(requirement.spec, config);
+		return requirement;
+	})() : void 0;
 	const store = new Store(config.stateDir);
 	try {
 		if (command === "enqueue") {
-			arity(args, 1, 1, "enqueue <spec.json|->");
-			const { spec, baseJobId } = parseRequirement(inputJSON(args[0]));
-			if (config.allowSubmit) validateAppleSpec(spec);
+			const { spec, baseJobId } = queuedRequirement;
 			print(view(store.enqueue(spec, config, baseJobId)));
 		} else if (command === "scan") {
 			arity(args, 0, 0, "scan [--observe]");
@@ -314,28 +623,26 @@ async function main() {
 		} else if (command === "retry") {
 			arity(args, 1, 1, "retry <id>");
 			print(view(store.transition(args[0], (job) => {
-				if (buildOnly && (job.config.allowSubmit || job.config.allowRelease)) throw new Error("--build-only refuses a task with snapshotted publication permission");
 				if (![
 					"blocked",
 					"ready",
 					"built"
 				].includes(job.status)) throw new Error(`Cannot retry ${job.status}; budgets and active work cannot be reset by retry`);
 				if (job.turn) throw new Error("Abandon the active host turn before changing task configuration");
-				const proofChanged = JSON.stringify(config.verification) !== JSON.stringify(job.config.verification) || JSON.stringify(config.executionEnv) !== JSON.stringify(job.config.executionEnv) || JSON.stringify(config.toolchain) !== JSON.stringify(job.config.toolchain) || job.verifiedDigest != null && !job.verifiedDependencyDigest;
-				if (proofChanged && Object.keys(job.receipt).length) throw new Error("Verification proof is no longer valid after publication began; reconcile the existing upload before creating a new version");
-				const patch = proofChanged && job.verifiedDigest ? {
-					stage: "verify",
-					verifiedDigest: null,
-					verifiedDependencyDigest: null,
-					review: null,
-					artifact: null
-				} : {};
+				if (job.cloudBuildPending) throw new Error("Cloud packaging outcome is uncertain; reconcile the existing provider run rather than replaying it with retry");
 				const resumedConfig = {
 					...config,
-					packageTarget: job.config.allowSubmit ? "ipa" : config.packageTarget,
-					allowSubmit: job.config.allowSubmit,
-					allowRelease: job.config.allowRelease
+					packageTarget: config.packageTarget
 				};
+				const patch = verificationConfigChanged(job, resumedConfig) ? {
+					...invalidateVerification(),
+					stage: [
+						"verify",
+						"review",
+						"package"
+					].includes(job.stage) ? "verify" : job.stage
+				} : {};
+				validateJobConfig(job.spec, resumedConfig);
 				return {
 					...patch,
 					config: resumedConfig,
@@ -345,62 +652,7 @@ async function main() {
 					error: null
 				};
 			})));
-		} else if (command === "authorize") {
-			arity(args, 1, 1, "authorize <id> --submit [--release]");
-			if (!values.submit) throw new Error("authorize requires --submit");
-			print(view(store.transition(args[0], (job) => {
-				if (job.turn || ![
-					"ready",
-					"blocked",
-					"built"
-				].includes(job.status) || Object.keys(job.receipt).length || job.stage === "monitor") throw new Error("Publication permission can change only on stopped work before any remote intent");
-				const publishing = validateAppleSpec(job.spec);
-				if (values.release && !/^[A-Za-z]{2}$/.test(publishing.storefrontCountry ?? "")) throw new Error("--release requires apple.storefrontCountry in the immutable product specification");
-				return {
-					config: {
-						...job.config,
-						packageTarget: "ipa",
-						allowSubmit: true,
-						allowRelease: Boolean(values.release)
-					},
-					status: ["ready", "built"].includes(job.status) ? "queued" : "blocked",
-					nextAt: Date.now()
-				};
-			})));
-		} else if (command === "feedback") {
-			arity(args, 2, 2, "feedback <id> <file>");
-			const feedback = readInputFile(args[1], "App Review feedback").toString("utf8").trim();
-			if (!feedback) throw new Error("App Review feedback file is empty");
-			print(view(store.transition(args[0], (job) => {
-				if (job.turn || job.stage !== "monitor" || job.appleReview?.status !== "rejected" || job.status !== "blocked") throw new Error("feedback is only allowed for an observed App Review rejection");
-				const spec = structuredClone(job.spec);
-				if (!spec.apple?.buildNumber || !/^\d+$/.test(spec.apple.buildNumber)) throw new Error("A numeric apple.buildNumber is required to prepare a replacement build");
-				spec.apple.buildNumber = String(BigInt(spec.apple.buildNumber) + 1n);
-				return {
-					spec,
-					config: {
-						...config,
-						packageTarget: job.config.allowSubmit ? "ipa" : config.packageTarget,
-						allowSubmit: job.config.allowSubmit,
-						allowRelease: job.config.allowRelease
-					},
-					feedback,
-					status: "queued",
-					stage: "build",
-					createdAt: Date.now(),
-					attempts: {},
-					hostTurns: 0,
-					nextAt: Date.now(),
-					receipt: {},
-					ipaPath: null,
-					archiveDigest: null,
-					verifiedDigest: null,
-					verifiedDependencyDigest: null,
-					review: null,
-					error: null
-				};
-			})));
-		}
+		} else throw new Error(`Unknown command ${command}; use --help`);
 	} finally {
 		store.close();
 	}