appstore-precheck 1.1.0

package/skills/appstore-precheck/evals/README.md

@@ -0,0 +1,40 @@
+# Evals
+
+Behavioral evaluations for the `appstore-precheck` skill, in the
+[Agent Skills eval format](https://agentskills.io/skill-creation/evaluating-skills)
+([`evals.json`](evals.json) + self-contained inputs under [`files/`](files/)).
+
+These test the **agent-behavior layer**: given a realistic submission-intent prompt and a throwaway
+iOS project, does the agent invoke the skill, run the scanner, reach the correct **GREEN/YELLOW/RED**
+verdict, and present it faithfully: one Pierre line as a thin wrapper, the scan's `FAIL`/`WARN`/`PASS`
+lines verbatim, never paraphrased? Each case carries `assertions` describing what a correct run must
+contain.
+
+| # | Case | Input | Expected |
+|---|------|-------|----------|
+| 1 | `red-blocks-submission` | `files/red-app` (Android mention + paywall missing links) | **RED**, no token |
+| 2 | `green-allows-submission` | `files/green-app` (clean + full paywall) | **GREEN**, token written |
+| 3 | `no-iap-skips-paywall-checks` | `files/no-iap-app` (no StoreKit) | 3.1.2 skipped, not RED |
+
+## Running them
+
+The official [`skill-creator`](https://code.claude.com/docs/en/skills#run-evals-with-skill-creator)
+plugin runs `evals.json` by spawning an isolated subagent per case (with-skill vs without-skill),
+capturing assertion pass/fail evidence into `grading.json` and aggregate stats into `benchmark.json`.
+
+You can also sanity-check the **mechanical** expectations directly: copy an input out of the repo
+(so the scanner treats it as its own project root) and run the scan + deterministic verdict:
+
+```bash
+tmp=$(mktemp -d); cp -R skills/appstore-precheck/evals/files/red-app/. "$tmp/"
+( cd "$tmp" && bash "$OLDPWD/skills/appstore-precheck/scripts/scan.sh" \
+    | bash "$OLDPWD/skills/appstore-precheck/scripts/verdict.sh" )
+# → VERDICT: RED   (green-app → GREEN; no-iap-app → GREEN with paywall checks skipped)
+```
+
+## Scope
+
+Evals cover agent behavior; they complement, not replace, the deterministic scanner suite in
+[`tests/`](../../../tests/) (verdict thresholds, the upload-guard hook, config overrides, the
+installer) and the live cross-host runs in
+[`docs/cross-tool-verification.md`](../../../docs/cross-tool-verification.md).

package/skills/appstore-precheck/evals/evals.json

@@ -0,0 +1,73 @@
+{
+  "skill_name": "appstore-precheck",
+  "description": "Behavioral evals for the appstore-precheck skill: does the agent invoke the skill, run the scanner, reach the correct GREEN/YELLOW/RED verdict, and present it faithfully (Pierre voice as a thin wrapper, scan output never paraphrased)? Inputs are self-contained throwaway iOS projects under evals/files/. The mechanical layer (scan.sh / verdict.sh / guard) is separately covered by the deterministic suite in tests/.",
+  "evals": [
+    {
+      "id": 1,
+      "name": "red-blocks-submission",
+      "prompt": "I'm about to submit this iOS app to the App Store. Run the appstore-precheck and tell me whether I can submit.",
+      "files": [
+        "evals/files/red-app/App/ContentView.swift",
+        "evals/files/red-app/App/SubscriptionView.swift",
+        "evals/files/red-app/App/Info.plist",
+        "evals/files/red-app/App/PrivacyInfo.xcprivacy",
+        "evals/files/red-app/fastlane/metadata/en-US/name.txt",
+        "evals/files/red-app/fastlane/metadata/en-US/subtitle.txt",
+        "evals/files/red-app/fastlane/metadata/en-US/description.txt",
+        "evals/files/red-app/fastlane/metadata/en-US/keywords.txt"
+      ],
+      "expected_output": "A RED verdict that blocks submission: the metadata names another platform (2.3.10) and the paywall is missing Restore Purchases, Terms of Use, and Privacy Policy (3.1.2). No .precheck-pass token is written.",
+      "assertions": [
+        "The verdict is RED and submission is reported as blocked",
+        "The .precheck-pass token is NOT written (it is removed/withheld)",
+        "Flags Guideline 2.3.10: the 'Android' / 'Google Play' reference in the metadata description",
+        "Flags Guideline 3.1.2: missing Restore Purchases, Terms of Use, and Privacy Policy on the paywall",
+        "The response opens with exactly one in-character Pierre line, then plain output",
+        "The scan's FAIL lines are shown verbatim (machine-faithful), not paraphrased or invented"
+      ]
+    },
+    {
+      "id": 2,
+      "name": "green-allows-submission",
+      "prompt": "Run the App Store pre-submission check on this project before I upload with fastlane.",
+      "files": [
+        "evals/files/green-app/App/ContentView.swift",
+        "evals/files/green-app/App/SubscriptionView.swift",
+        "evals/files/green-app/App/Info.plist",
+        "evals/files/green-app/App/PrivacyInfo.xcprivacy",
+        "evals/files/green-app/fastlane/metadata/en-US/name.txt",
+        "evals/files/green-app/fastlane/metadata/en-US/subtitle.txt",
+        "evals/files/green-app/fastlane/metadata/en-US/description.txt",
+        "evals/files/green-app/fastlane/metadata/en-US/keywords.txt"
+      ],
+      "expected_output": "A GREEN verdict: no FAILs. The paywall has Restore/Terms/Privacy and the metadata is clean, so the .precheck-pass token is written.",
+      "assertions": [
+        "The verdict is GREEN",
+        "The .precheck-pass token is written",
+        "Confirms Restore Purchases, Terms of Use, and Privacy Policy are present on the paywall",
+        "Reports zero FAIL lines",
+        "The response opens with exactly one in-character Pierre line"
+      ]
+    },
+    {
+      "id": 3,
+      "name": "no-iap-skips-paywall-checks",
+      "prompt": "Is this app ready for the App Store? Run the precheck.",
+      "files": [
+        "evals/files/no-iap-app/App/ContentView.swift",
+        "evals/files/no-iap-app/App/Info.plist",
+        "evals/files/no-iap-app/App/PrivacyInfo.xcprivacy",
+        "evals/files/no-iap-app/fastlane/metadata/en-US/name.txt",
+        "evals/files/no-iap-app/fastlane/metadata/en-US/subtitle.txt",
+        "evals/files/no-iap-app/fastlane/metadata/en-US/description.txt",
+        "evals/files/no-iap-app/fastlane/metadata/en-US/keywords.txt"
+      ],
+      "expected_output": "No in-app-purchase signals are present, so the 3.1.2 paywall checks are skipped (not failed). The verdict is not RED.",
+      "assertions": [
+        "Detects no in-app-purchase / subscription signals and skips the 3.1.2 paywall checks",
+        "Does NOT report any 3.1.2 paywall FAIL (missing Restore/Terms/Privacy)",
+        "The verdict is not RED"
+      ]
+    }
+  ]
+}

package/skills/appstore-precheck/evals/files/green-app/App/ContentView.swift

@@ -0,0 +1,2 @@
+import SwiftUI
+struct ContentView: View { var body: some View { TabView { Text("Home"); Text("Settings") } } }

package/skills/appstore-precheck/evals/files/green-app/App/Info.plist

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict><key>CFBundleDisplayName</key><string>Demo</string><key>ITSAppUsesNonExemptEncryption</key><false/></dict></plist>

package/skills/appstore-precheck/evals/files/green-app/App/PrivacyInfo.xcprivacy

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict><key>NSPrivacyTracking</key><false/><key>NSPrivacyAccessedAPITypes</key><array/></dict></plist>

package/skills/appstore-precheck/evals/files/green-app/App/SubscriptionView.swift

@@ -0,0 +1,13 @@
+import SwiftUI
+import StoreKit
+struct SubscriptionView: View {
+    var body: some View {
+        VStack {
+            Button("Subscribe") {}
+            Button("Restore Purchases") { restorePurchases() }
+            Link("Terms of Use", destination: URL(string: "https://example.com/terms")!)
+            Link("Privacy Policy", destination: URL(string: "https://example.com/privacy")!)
+        }
+    }
+    func restorePurchases() {}
+}

package/skills/appstore-precheck/evals/files/green-app/fastlane/metadata/en-US/description.txt

@@ -0,0 +1 @@
+A focus and habit app that helps you build better routines.

package/skills/appstore-precheck/evals/files/green-app/fastlane/metadata/en-US/keywords.txt

@@ -0,0 +1 @@
+focus,habits

package/skills/appstore-precheck/evals/files/green-app/fastlane/metadata/en-US/name.txt

@@ -0,0 +1 @@
+Demo App

package/skills/appstore-precheck/evals/files/green-app/fastlane/metadata/en-US/privacy_url.txt

@@ -0,0 +1 @@
+https://demo.example-app.app/privacy

package/skills/appstore-precheck/evals/files/green-app/fastlane/metadata/en-US/subtitle.txt

@@ -0,0 +1 @@
+Focus

package/skills/appstore-precheck/evals/files/green-app/fastlane/metadata/en-US/support_url.txt

@@ -0,0 +1 @@
+https://demo.example-app.app/support

package/skills/appstore-precheck/evals/files/no-iap-app/App/ContentView.swift

@@ -0,0 +1,2 @@
+import SwiftUI
+struct ContentView: View { var body: some View { TabView { Text("Home"); Text("Settings") } } }

package/skills/appstore-precheck/evals/files/no-iap-app/App/Info.plist

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict><key>CFBundleDisplayName</key><string>Demo</string></dict></plist>

package/skills/appstore-precheck/evals/files/no-iap-app/App/PrivacyInfo.xcprivacy

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict><key>NSPrivacyTracking</key><false/><key>NSPrivacyAccessedAPITypes</key><array/></dict></plist>

package/skills/appstore-precheck/evals/files/no-iap-app/fastlane/metadata/en-US/description.txt

@@ -0,0 +1 @@
+A simple offline notes app with no purchases.

package/skills/appstore-precheck/evals/files/no-iap-app/fastlane/metadata/en-US/keywords.txt

@@ -0,0 +1 @@
+notes

package/skills/appstore-precheck/evals/files/no-iap-app/fastlane/metadata/en-US/name.txt

@@ -0,0 +1 @@
+Demo App

package/skills/appstore-precheck/evals/files/no-iap-app/fastlane/metadata/en-US/subtitle.txt

@@ -0,0 +1 @@
+Notes

package/skills/appstore-precheck/evals/files/red-app/App/ContentView.swift

@@ -0,0 +1,2 @@
+import SwiftUI
+struct ContentView: View { var body: some View { TabView { Text("Home"); Text("Settings") } } }

package/skills/appstore-precheck/evals/files/red-app/App/Info.plist

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict><key>CFBundleDisplayName</key><string>Demo</string></dict></plist>

package/skills/appstore-precheck/evals/files/red-app/App/PrivacyInfo.xcprivacy

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict><key>NSPrivacyTracking</key><false/><key>NSPrivacyAccessedAPITypes</key><array/></dict></plist>

package/skills/appstore-precheck/evals/files/red-app/App/SubscriptionView.swift

@@ -0,0 +1,3 @@
+import SwiftUI
+import StoreKit
+struct SubscriptionView: View { var body: some View { Button("Subscribe") {} } }

package/skills/appstore-precheck/evals/files/red-app/fastlane/metadata/en-US/description.txt

@@ -0,0 +1 @@
+A great focus app. Also available on Android and Google Play.

package/skills/appstore-precheck/evals/files/red-app/fastlane/metadata/en-US/keywords.txt

@@ -0,0 +1 @@
+focus

package/skills/appstore-precheck/evals/files/red-app/fastlane/metadata/en-US/name.txt

@@ -0,0 +1 @@
+Demo App

package/skills/appstore-precheck/evals/files/red-app/fastlane/metadata/en-US/subtitle.txt

@@ -0,0 +1 @@
+Focus

package/skills/appstore-precheck/guidelines-baseline.json

@@ -0,0 +1,35 @@
+{
+  "_doc": "Baseline of Apple App Store Review Guidelines section numbers, for drift detection. Phase 0 fetches the live guidelines page and diffs its section numbers against `all_sections`; any NEW/REMOVED number => WARN: guideline-drift. This file is updated ONLY by deliberate human reconciliation (see SKILL.md Phase 0), NEVER auto-edited by the skill, otherwise the warning would be silently swallowed.",
+  "source_url": "https://developer.apple.com/app-store/review/guidelines/",
+  "reconciled_on": "2026-06-24",
+  "apple_last_updated_seen": "not-exposed-in-DOM (the page shows no visible date stamp; drift signal = the set of section numbers)",
+  "drift_check_coverage": "Reliable for Sections 1-4 + 5.1-5.4 (high-churn regions: 2.5.x, 3.1.x, 4.7, 5.1.x). The 5.5-5.6.x tail can't be fetched (the page truncates ~5.4) and is structurally stable; review it by hand at reconciliation.",
+  "covered_by_scan": [
+    "2.3.1", "2.3.3", "2.3.7", "2.3.10",
+    "2.5.1",
+    "3.1.2",
+    "4.0",
+    "5.1.1", "5.1.2", "5.1.5"
+  ],
+  "all_sections": [
+    "1.1", "1.1.1", "1.1.2", "1.1.3", "1.1.4", "1.1.5", "1.1.6", "1.1.7",
+    "1.2", "1.2.1", "1.3", "1.4", "1.4.1", "1.4.2", "1.4.3", "1.4.4", "1.4.5",
+    "1.5", "1.6", "1.7",
+    "2.1", "2.2", "2.3", "2.3.1", "2.3.2", "2.3.3", "2.3.4", "2.3.5", "2.3.6",
+    "2.3.7", "2.3.8", "2.3.9", "2.3.10", "2.3.11", "2.3.12", "2.3.13",
+    "2.4", "2.4.1", "2.4.2", "2.4.3", "2.4.4", "2.4.5",
+    "2.5", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.5.6", "2.5.8", "2.5.9",
+    "2.5.11", "2.5.12", "2.5.13", "2.5.14", "2.5.15", "2.5.16", "2.5.17", "2.5.18",
+    "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5",
+    "3.2", "3.2.1", "3.2.2",
+    "4.1", "4.2", "4.2.1", "4.2.2", "4.2.3", "4.2.6", "4.2.7",
+    "4.3", "4.4", "4.4.1", "4.4.2",
+    "4.5", "4.5.1", "4.5.2", "4.5.3", "4.5.4", "4.5.5", "4.5.6",
+    "4.7", "4.7.1", "4.7.2", "4.7.3", "4.7.4", "4.7.5",
+    "4.8", "4.9", "4.10",
+    "5.1", "5.1.1", "5.1.2", "5.1.3", "5.1.4", "5.1.5",
+    "5.2", "5.2.1", "5.2.2", "5.2.3", "5.2.4", "5.2.5",
+    "5.3", "5.3.1", "5.3.2", "5.3.3", "5.3.4",
+    "5.4", "5.5", "5.6", "5.6.1", "5.6.2", "5.6.3", "5.6.4", "5.6.5", "5.6.6", "5.6.7"
+  ]
+}

package/skills/appstore-precheck/references/methodology.md

@@ -0,0 +1,131 @@
+# Methodology: App Store Precheck
+
+The detailed reference behind the skill. Read the section you need; you do not need to read this
+whole file to run the skill.
+
+## Contents
+
+- [Phase 0: Guideline drift check](#phase-0-guideline-drift-check)
+- [Phase 1: Rejection vectors](#phase-1-rejection-vectors)
+- [Auto-detection rules](#auto-detection-rules)
+- [Verdict thresholds](#verdict-thresholds)
+- [Pre-submit manual checklist](#pre-submit-manual-checklist)
+
+---
+
+## Phase 0: Guideline drift check
+
+**Why:** the scanner's checks and `fastlane precheck`'s rule engine are static and hand-maintained.
+Apple changes the [App Store Review Guidelines](https://developer.apple.com/app-store/review/guidelines/)
+without notice. This phase flags whether any guideline **section number was added or removed**
+since the last reconciliation, catching drift without manual upkeep. It is **always
+non-blocking (WARN at most)**: drift is a gap in *our* coverage, never a fault of the build.
+
+**Mechanics.** Read `guidelines-baseline.json`, then fetch the live page and diff its section
+numbers against `all_sections`. The fetcher's sub-model truncates this single long page after
+~5.4, so do **two focused passes**, each embedding only the relevant slice of `all_sections`:
+
+- **Pass A (Sections 1–3):** "Report ONLY (NEW) section numbers present on the live page but
+  missing from this list, and (REMOVED) numbers in the list but absent. Ignore parenthetical
+  (a)/(b) suffixes. If nothing differs, output NO DRIFT."
+- **Pass B (Section 4 + 5.1–5.4):** same, plus "The page reliably truncates after ~5.4, that is
+  EXPECTED; do NOT report 5.5/5.6.x as removed and do NOT output TRUNCATED for the tail."
+- **Tail 5.5–5.6.x** can't be fetched reliably and is structurally the most stable section
+  (Developer Code of Conduct); review it by hand during reconciliation.
+
+**Interpretation (always WARN at most):**
+
+- `NO DRIFT` → `PASS: guideline-drift none (baseline reconciled <reconciled_on>)`
+- NEW/REMOVED → `WARN: guideline-drift — NEW: <…> / REMOVED: <…>. Review the live page; add a
+  check to scan.sh if relevant, then reconcile the baseline.`
+- fetch failed/truncated → `WARN: guideline-drift-check degraded — verify manually.`
+
+**Reconciliation (a deliberate human step):** review the drift, optionally add a scan check for a
+newly relevant section, then update `guidelines-baseline.json`, add/remove the section numbers
+in `all_sections` and set `reconciled_on` to today. **Never auto-update the baseline:** doing so
+would silently swallow the warning and defeat the entire purpose of drift detection.
+
+**Limit:** this detects only *structural* drift (the set of section numbers). A section whose
+number is unchanged but whose *text* changed is not caught here, but is partly covered by
+Phase 2 (Apple's own rule engine) and Phase 3 (the adversarial reviewer). Apple does not expose a
+machine-readable "last updated" date in the page DOM, so the section-number set is the signal.
+
+---
+
+## Phase 1: Rejection vectors
+
+`scripts/scan.sh` checks the following. Each emits `FAIL:` / `WARN:` / `PASS:` with a location.
+
+| # | Guideline | What it checks |
+|---|-----------|----------------|
+| 1 | **5.1.1(v) Privacy Manifest** | Required Reason API usage (`UserDefaults`/`@AppStorage`, file timestamp, system boot time, disk space, active keyboard) ↔ `PrivacyInfo.xcprivacy` declaration parity |
+| 2 | **5.1.1 Purpose Strings** | Every imported sensitive framework (FamilyControls, CoreLocation, AVFoundation, Photos, Contacts, HealthKit) has a non-empty `NS*UsageDescription` in Info.plist |
+| 3 | **5.1.2 ATT** | If `AppTrackingTransparency`/`ATTrackingManager` is used, `NSUserTrackingUsageDescription` is present |
+| 4 | **2.3.10 Other platforms** | No "Android" / "Google Play" / competitor store names in store metadata |
+| 5 | **2.3.1 Metadata limits** | name ≤30, subtitle ≤30, keywords ≤100, promotional_text ≤170, description ≤4000 (Unicode codepoints, matching ASC) |
+| 6 | **2.3.7 Localized parity** | Every detected locale has name + subtitle + description + keywords |
+| 7 | **2.3.3 Screenshots** | Each locale folder has at least one screenshot (warns if <3) |
+| 8 | **3.1.2 Trial disclosure** | If trial wording exists, a trial→paid auto-renew disclosure key exists |
+| 9 | **3.1.2 Auto-renew disclosure** | A subscription disclosure string exists and covers each locale |
+| 10 | **3.1.2 Required links** | The paywall view contains Restore Purchases + Terms of Use (EULA) + Privacy Policy |
+| 11 | **2.5.1 Private API** | No banned identifiers (`UIWebView`, `setSelectionIndicatorImage`, `_UIBackdropView`, `NSURLConnection`, …) |
+| 12 | **4.0 Minimum functionality** | At least one navigation hub (`TabView` / `NavigationStack` / `NavigationSplitView`) |
+| 13 | **5.1.5 Sensitive APIs** *(opt-in)* | If FamilyControls is used and `optionalChecks.familyControls` is on, a reviewer-notes justification exists |
+| 14 | **4.8 Sign in with Apple** *(advisory)* | If a third-party social login SDK (Google, Facebook, Auth0, …) is used, Sign in with Apple is offered too |
+| 15 | **3.1.1(a) External purchase link** *(advisory)* | If StoreKit External Purchase APIs or the entitlement are present, the 3.1.1(a) disclosure/reporting requirements are flagged |
+| 16 | **5.1.2 Tracking SDK / IDFA** *(advisory)* | If an ad / attribution SDK (AdMob, AppLovin, AppsFlyer, Adjust, Branch, IronSource) or raw IDFA access is present but no ATT prompt is, it is flagged (the reverse of vector 3) |
+| 17 | **Export compliance** *(advisory)* | If a checked-in Info.plist lacks `ITSAppUsesNonExemptEncryption`, set it (true/false) to skip the App Store Connect encryption-export question |
+| 18 | **2.3 Support / Privacy URL** *(advisory)* | fastlane metadata has a non-empty `support_url.txt` and `privacy_url.txt` across locales, with no placeholder URLs |
+| 19 | **5.1.1 Privacy manifest** *(advisory)* | If an analytics SDK (Firebase, Amplitude, Mixpanel, Sentry, Segment, Bugsnag, App Center, Datadog) is linked but `PrivacyInfo.xcprivacy` declares no collected data types or tracking domains, it is flagged |
+| 20 | **2.1 Placeholder content** *(advisory)* | No lorem ipsum / TODO / FIXME / `example.com` / "insert X here" / changeme in store metadata |
+
+Vectors 8–10 only run when in-app-purchase signals are detected (StoreKit / RevenueCat import,
+or a paywall view). Otherwise the scanner emits a single PASS and skips them. Vectors 16–20 are
+signal-gated advisory WARNs: each emits nothing unless its triggering signal is present.
+
+---
+
+## Auto-detection rules
+
+When `.appstore-precheck.json` does not pin a path, the scanner derives it:
+
+- **iOS source dir**: the `Info.plist` directory (excluding `.git`, Pods, Carthage, `.build`,
+  `build`, DerivedData, SwiftPM `SourcePackages`/`checkouts`/`.swiftmp`, `.claude`/`worktrees`,
+  `node_modules`, `vendor`) that holds the most Swift files. This is the app target, not a dependency.
+- **metadata / screenshots dir**: the shallowest `**/fastlane/metadata` and `**/fastlane/screenshots`.
+- **String Catalog**: the first `Localizable.xcstrings`, else the first `*.xcstrings`.
+- **Paywall view**: first file matching `*SubscriptionView*`, `*PaywallView*`, `*Paywall*`,
+  `*…View.swift` (override with `paywallGlobs`).
+- **Locales**: the directory names under `metadataDir` (override with a `locales` array).
+
+All path matching prunes the dependency/build/worktree trees above and prefers the shallowest
+match, so a vendored SwiftPM checkout is never mistaken for the app.
+
+---
+
+## Verdict thresholds
+
+| State | Rule |
+|-------|------|
+| **GREEN** | 0 FAIL and ≤2 WARN → write `.precheck-pass` (valid 60 min) |
+| **YELLOW** | 0 FAIL and ≥3 WARN → no token; require explicit user confirmation to proceed |
+| **RED** | ≥1 FAIL → no token; submission blocked until fixed |
+
+The guideline-drift WARN from Phase 0 counts toward the same WARN threshold; on its own it never
+blocks, but it can be the third WARN that tips GREEN into YELLOW.
+
+---
+
+## Pre-submit manual checklist
+
+Things the scanner cannot verify; confirm by hand before you submit:
+
+```
+[ ] App Privacy Nutrition Labels in App Store Connect match PrivacyInfo.xcprivacy
+[ ] ASC App Review Information: demo account / notes filled in
+[ ] Sandbox tester: at least 1 purchase + 1 restore tested end to end
+[ ] TestFlight crash-free over the last 24h > 99.5%
+[ ] Build number incremented from the previous submission
+[ ] Export compliance (encryption) answered
+[ ] If using "Sign in with Apple" alongside other social logins, it is offered
+```

package/skills/appstore-precheck/scripts/phase2-precheck.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# appstore-precheck/scripts/phase2-precheck.sh
+# Phase 2 wrapper: build the App Store Connect API key JSON from the environment,
+# run Apple's `fastlane precheck`, then delete the key. The key is created with a
+# restrictive mode and removed on exit (even on failure), so it never lingers and
+# is never committed.
+#
+# Env (required): ASC_KEY_ID, ASC_ISSUER_ID, ASC_P8_PATH (path to the .p8 file).
+# App identifier: first positional arg, or $APP_IDENTIFIER.
+#
+# Usage:
+#   ASC_KEY_ID=... ASC_ISSUER_ID=... ASC_P8_PATH=/path/AuthKey.p8 \
+#     bash phase2-precheck.sh com.example.app
+#   bash phase2-precheck.sh --dry-run com.example.app   # build+validate the key JSON
+#                                                        # and print the command, no
+#                                                        # network and no real key needed
+set -euo pipefail
+
+DRY=false
+APP_ID="${APP_IDENTIFIER:-}"
+for arg in "$@"; do
+  case "$arg" in
+    --dry-run) DRY=true ;;
+    -*) echo "phase2-precheck.sh: unknown option '$arg'" >&2; exit 64 ;;
+    *)  APP_ID="$arg" ;;
+  esac
+done
+
+: "${ASC_KEY_ID:?set ASC_KEY_ID (App Store Connect API key id)}"
+: "${ASC_ISSUER_ID:?set ASC_ISSUER_ID (App Store Connect issuer id)}"
+: "${ASC_P8_PATH:?set ASC_P8_PATH (path to the .p8 private key)}"
+[[ -n "$APP_ID" ]] || { echo "usage: phase2-precheck.sh <app_identifier> (or set APP_IDENTIFIER)" >&2; exit 64; }
+
+command -v jq >/dev/null 2>&1 || { echo "phase2-precheck.sh: jq is required" >&2; exit 69; }
+
+KEYJSON="$(mktemp -t asc-key.XXXXXX)"
+trap 'rm -f "$KEYJSON"' EXIT
+
+# Build the key JSON. A real run reads the .p8 from disk; --dry-run tolerates a
+# missing file (treats ASC_P8_PATH as literal key text) so it can be exercised in
+# tests and previews without real credentials.
+if [[ -f "$ASC_P8_PATH" ]]; then
+  jq -n --arg kid "$ASC_KEY_ID" --arg iss "$ASC_ISSUER_ID" --rawfile key "$ASC_P8_PATH" \
+     '{key_id:$kid, issuer_id:$iss, key:$key, in_house:false}' > "$KEYJSON"
+elif $DRY; then
+  jq -n --arg kid "$ASC_KEY_ID" --arg iss "$ASC_ISSUER_ID" --arg key "$ASC_P8_PATH" \
+     '{key_id:$kid, issuer_id:$iss, key:$key, in_house:false}' > "$KEYJSON"
+else
+  echo "phase2-precheck.sh: .p8 not found at $ASC_P8_PATH" >&2; exit 66
+fi
+chmod 600 "$KEYJSON"
+
+# The verbatim Phase 2 command (IAP is covered by Phase 1, so it is excluded here).
+CMD=( fastlane run precheck
+      "app_identifier:$APP_ID"
+      "api_key_path:$KEYJSON"
+      include_in_app_purchases:false
+      default_rule_level::error )
+
+if $DRY; then
+  echo "DRY-RUN: would run: ${CMD[*]}"
+  jq -e '.key_id and .issuer_id and .key' "$KEYJSON" >/dev/null \
+    && echo "key json OK" || { echo "key json INVALID" >&2; exit 1; }
+  exit 0
+fi
+
+command -v fastlane >/dev/null 2>&1 || { echo "phase2-precheck.sh: fastlane is required" >&2; exit 69; }
+"${CMD[@]}"