appstore-precheck 1.1.1 → 1.5.1

package/skills/appstore-precheck/references/pierre-deep-review.md

@@ -0,0 +1,272 @@
+# Phase 4: Pierre deep review (28 semantic checks)
+
+After Phase 3 (explaining every scan FAIL/WARN), Pierre runs a **read-only, project-wide
+semantic review** of 28 guideline areas the static scanner cannot fully judge. Checks **1–22**
+(minus Tier B items below) are high-confidence (Tier A); checks **4, 5, 7, 10, 15, and 28** are
+heuristic advisory (Tier B v1 — higher false-positive risk, still useful pre-submit signals).
+
+This is the **Review Simulator** layer: Pierre reads Swift, metadata, entitlements, screenshots,
+xcstrings, paywall views, review notes, and fetches live privacy/support URLs — then cross-checks
+claims against evidence.
+
+**This phase does not change the GREEN/YELLOW/RED verdict.** Verdict counts come only from
+Phases 0–2 (`FAIL:` / `WARN:` lines). Phase 4 emits `REVIEW-PASS:` or `REVIEW-FINDING:` lines
+that Pierre explains in Phase 5 presentation.
+
+## Rules
+
+- **Read-only:** never modify project files.
+- **Evidence-based:** cite `file:line`, metadata path, screenshot filename, or fetched URL text.
+  If you cannot read something (private URL, missing file), say so — do not invent findings.
+- **All 28 checks, every run:** report each item as `REVIEW-PASS:` or `REVIEW-FINDING:` — no skipping.
+- **REVIEW-FINDING severity:** always `WARN` (advisory). Never emit `REVIEW-FINDING: … FAIL`.
+  A deep-review issue informs the human; it does not block the token by itself.
+- **Tier B checks (4, 5, 7, 10, 15, 28):** prefer `REVIEW-PASS: … — not applicable` when the signal is absent;
+  when flagging, use cautious language ("may trigger review questions") — these are heuristics.
+- **Deepen scan hits:** when Phase 1 already flagged a guideline, Phase 4 still runs the matching
+  deep check and adds semantic context (do not repeat the machine line verbatim — add what the
+  scanner could not see).
+- **WebFetch:** use `WebFetch` (or equivalent) on `privacy_url.txt` and `support_url.txt` when
+  present. If fetch fails, `REVIEW-FINDING: … WARN — could not fetch privacy policy; verify manually`.
+- **Screenshots:** read at least one PNG/JPEG per primary locale; compare visible UI/features to
+  metadata claims.
+- **Language:** write Pierre's 2–3 sentence explanations in the user's conversation language.
+
+## Output format
+
+For each of the 28 checks (in table order):
+
+```
+REVIEW-PASS: <guideline> — <one-line why it looks OK, with evidence pointer>
+```
+
+or
+
+```
+REVIEW-FINDING: <guideline> WARN — <one-line concrete mismatch or gap, with evidence pointer>
+Pierre: <2–3 sentences: why Apple cares, what you found, what to fix or verify>
+```
+
+If a check is **not applicable** (e.g. no HealthKit, no VPN, no contest copy), still report:
+
+```
+REVIEW-PASS: <guideline> — not applicable (<reason>)
+```
+
+---
+
+## The 28 checks (guideline order)
+
+| # | Guideline | Deep question | Primary sources |
+|---|-----------|---------------|-----------------|
+| 1 | **1.2.1** | UGC present → is there a real report/block/moderation UI flow, not just keywords in copy? | Swift navigation, moderation views, §22 scan context |
+| 2 | **1.4.1** | Health/medical/wellness claims in metadata or UI without appropriate disclaimers or HealthKit compliance? | metadata, Swift HealthKit usage, onboarding copy |
+| 3 | **2.1** | Metadata/marketing claims match implemented features (AI, offline, ad-block, sync, etc.)? | metadata, description, Swift feature grep |
+| 4 | **2.1** | Login-gated app → App Review demo account / notes **actionable** (credentials, steps, not placeholder)? | `review_information/`, `.reviewPrepNotes`, §31 scan context |
+| 5 | **2.2** | Store-facing copy or UI still says beta / test / preview / work-in-progress? | metadata, release_notes, Swift UI strings |
+| 6 | **2.3.2** | Primary category plausible for app type (game vs utility vs health, etc.)? | fastlane `primary_category`, metadata tone, code structure |
+| 7 | **2.3.4** | App preview assets present → features shown match the shipped app and metadata? | preview video paths, metadata, Swift UI |
+| 8 | **2.3.5** | Screenshots show features the app actually ships; no misleading device frames or competitor UI? | screenshot images, metadata, Swift UI |
+| 9 | **2.3.6** | Pricing/subscription language in metadata matches paywall (free vs paid, trial terms)? | metadata, paywall Swift, xcstrings |
+| 10 | **2.3.9** | Incentivized review copy ("rate 5 stars", "review for reward") in metadata or UI? | metadata, onboarding, paywall, §25 scan context |
+| 11 | **2.3.11–2.3.13** | Cross-locale metadata consistent (feature lists, trial terms, support/privacy URLs, pricing claims)? | all `fastlane/metadata/*` locales |
+| 12 | **3.1.1** | Digital goods sold or unlocked via external purchase links (web checkout, Stripe in WebView)? | Swift WebView/paywall, metadata, entitlements |
+| 13 | **3.1.2** | Subscription/trial/auto-renew/cancel disclosures are **legible sentences**, not keyword stubs? | paywall views, xcstrings, String Catalog |
+| 14 | **4.2.1–4.2.2** | App is more than a thin shell: meaningful navigation, native affordances, not a lone WebView brochure? | Swift UI structure, §12/§35 scan context |
+| 15 | **4.5.1–4.5.3** | Push or HomeKit entitlement → used as intended (no spam-push promises; HomeKit without home UI)? | entitlements, Info.plist, metadata, Swift |
+| 16 | **4.8** | Third-party login present → Sign in with Apple offered, or a documented exempt case (enterprise, existing account, etc.)? | login Swift, SDK imports, §14 scan context |
+| 17 | **5.1.1(i)** | Privacy policy text (fetched) matches data collection in code, PrivacyInfo, and App Privacy narrative? | fetch privacy URL, PrivacyInfo, SDK imports |
+| 18 | **5.1.1(ii)** | Purpose strings are specific and tied to a visible feature (not empty, generic, or copy-paste)? | Info.plist, permission usage in Swift |
+| 19 | **5.1.1(iii)** | Data/permission requests proportionate to stated app purpose (no obvious over-collection)? | permissions, SDKs vs metadata promise |
+| 20 | **5.1.1(iv)** | Permission denial handled gracefully — no infinite re-prompt loops or hard blocks without explanation? | location/camera/notification/auth flows in Swift |
+| 21 | **5.1.2** | ATT prompt, `NSUserTrackingUsageDescription`, privacy policy tracking section, and ad SDK usage align? | Info.plist, policy fetch, ad SDK imports |
+| 22 | **5.1.3** | HealthKit data not used for advertising/marketing; sync paths respect health-data rules? | HealthKit + analytics/ad SDK co-use |
+| 23 | **5.1.4** | Kids-audience signals → parental gate before external links/purchases/account areas? | metadata kids wording, parental gate UI |
+| 24 | **5.4** | VPN/NetworkExtension → on-screen disclosure text visible in UI strings (not only Info.plist)? | Swift strings, NetworkExtension usage |
+| 25 | **5.2.1–5.2.3** | Obvious third-party trademark/brand misuse in metadata, assets, or UI copy? | metadata, asset filenames, Swift strings |
+| 26 | **5.3.1–5.3.3** | Contest/sweepstakes/lottery copy → official rules/eligibility/disclosure present in metadata? | description, keywords, in-app contest UI |
+| 27 | **5.6.2–5.6.3** | Developer identity consistent: app name, support URL content, bundle/marketing domain match? | fetch support URL, metadata, legal/footer copy |
+| 28 | **5.6.4–5.6.7** | Rating/review manipulation dark patterns (withhold features until 5 stars, direct write-review links without `requestReview`)? | Swift, metadata, §25 scan context |
+
+---
+
+## Per-check procedure (detail)
+
+### 1 — 1.2.1 UGC moderation UI
+
+1. If no UGC signals (posts, comments, chat, uploads), mark not applicable.
+2. Search Swift for report/block/flag/moderate flows and screens reachable from content.
+3. Compare to metadata promises ("community", "share", "chat").
+4. Flag if UGC exists but moderation is only mentioned in text, not implemented in UI.
+
+### 2 — 1.4.1 Health / medical claims
+
+1. Scan metadata and onboarding for diagnose, treat, cure, clinical, FDA, blood pressure, etc.
+2. If HealthKit present, check disclaimers ("not a medical device") where claims exist.
+3. Flag unsubstantiated treatment claims without appropriate health disclaimers.
+
+### 3 — 2.1 Claims ↔ code
+
+1. Extract feature claims from name, subtitle, description, keywords (AI, ML, offline, block ads, VPN, etc.).
+2. Grep Swift / imports for matching implementation.
+3. Flag prominent metadata claims with no code evidence.
+
+### 4 — 2.1 Review notes / demo account quality *(Tier B v1)*
+
+1. If the app is login-gated (`SecureField`, Login/SignIn views) or scan §31 flagged missing demo:
+   read `fastlane/metadata/*/review_information/` (username, password, notes) and
+   `.appstore-precheck.json` → `reviewPrepNotes` if set.
+2. Flag empty notes, placeholder credentials (`test`, `demo`, `changeme`, `TBD`), or notes that
+   do not explain how to reach core features (subscription paywall, Screen Time blocking, etc.).
+3. If the app is not login-gated and has no account wall, mark not applicable.
+
+### 5 — 2.2 Beta / test language *(Tier B v1)*
+
+1. Grep store metadata, `release_notes.txt`, and user-visible Swift strings (not code comments) for:
+   `beta`, `testflight`, `test flight`, `preview`, `pre-release`, `work in progress`, `WIP`,
+   `under development`, `not final`, `experimental`.
+2. Exclude legitimate internal keys and developer log strings not shown to users.
+3. Flag any store-facing copy implying the App Store build is unfinished or a beta.
+
+### 6 — 2.3.2 Category fit
+
+1. Read primary category if present in fastlane or `.appstore-precheck.json`.
+2. Infer app type from code (game loop, utility, reader, social).
+3. Flag obvious mismatch (arcade game filed as Productivity).
+
+### 7 — 2.3.4 App preview consistency *(Tier B v1)*
+
+1. Look for app preview assets under `fastlane/metadata/*/preview*` or `*.mov` / `*.mp4` in metadata trees.
+2. If no preview assets in-repo, mark not applicable (previews may live only in App Store Connect).
+3. If previews exist: compare visible features/captions to metadata and Swift UI; flag previews
+   showing features absent from the build.
+
+### 8 — 2.3.5 Screenshots vs reality
+
+1. Open ≥1 screenshot per primary locale.
+2. List visible features (tabs, paywall, login, maps, etc.).
+3. Flag screenshots showing features absent from the build or metadata.
+
+### 9 — 2.3.6 Pricing language
+
+1. Compare metadata "free", trial, and price claims to paywall/subscription UI strings.
+2. Flag "completely free" metadata when IAP/paywall exists without clear disclosure.
+
+### 10 — 2.3.9 Incentivized review *(Tier B v1)*
+
+1. Grep metadata, onboarding, and paywall strings for: `rate us`, `leave a review`, `5 star`,
+   `five star`, `review and get`, `gift card`, `reward for review`, `write a review to unlock`.
+2. Cross-check scan §25 (custom review prompt) — Phase 4 adds semantic context if §25 passed.
+3. Flag quid-pro-quo review incentives or star-rating manipulation copy.
+
+### 11 — 2.3.11–2.3.13 Locale parity (semantic)
+
+1. Beyond scan's file-presence check: compare trial terms, feature bullets, and pricing claims across locales.
+2. Flag material omissions (trial mentioned in en-US only, different feature lists).
+
+### 12 — 3.1.1 External digital purchase
+
+1. Search for external checkout URLs, Stripe/PayPal in WebView, "subscribe on our website".
+2. Flag digital unlocks that bypass StoreKit without 3.1.1(a) entitlement context.
+
+### 13 — 3.1.2 Disclosure quality
+
+1. Read paywall disclosure strings (Swift + xcstrings).
+2. Flag if trial/auto-renew/cancel info is a single keyword, lorem, or unreadably dense.
+3. Require human-readable sentences covering trial length, renewal, and cancellation path.
+
+### 14 — 4.2.1–4.2.2 Minimum functionality (semantic)
+
+1. Map primary user journeys (launch → core action).
+2. Flag single-screen WebView brochure, template placeholder flows, or no native navigation beyond §12 minimum.
+
+### 15 — 4.5.1–4.5.3 Push / HomeKit abuse *(Tier B v1)*
+
+1. Read entitlements and Info.plist for push notifications and HomeKit.
+2. **Push:** if push entitlement present, scan metadata/UI for spam patterns ("notify every hour",
+   "unlimited reminders") unrelated to user-initiated alerts.
+3. **HomeKit:** if HomeKit framework imported, confirm home-automation UI exists; flag HomeKit
+   import with no home-related features (possible misuse).
+4. If neither push nor HomeKit signals, mark not applicable.
+
+### 16 — 4.8 Sign in with Apple (context)
+
+1. If Google/Facebook/etc. login exists, confirm `ASAuthorizationAppleID` / Sign in with Apple button.
+2. If absent, assess exempt patterns (enterprise-only, password-only existing users) — flag uncertain cases for human review.
+
+### 17 — 5.1.1(i) Privacy policy accuracy
+
+1. Fetch privacy URL from primary locale metadata.
+2. Compare policy statements to: PrivacyInfo collected types, tracking domains, location/camera/health SDK usage.
+3. Flag direct contradictions ("we do not collect location" + CoreLocation).
+
+### 18 — 5.1.1(ii) Purpose string quality
+
+1. List every `NS*UsageDescription` in Info.plist.
+2. Flag empty, placeholder, or generic strings; flag mismatch with the feature that triggers the prompt.
+
+### 19 — 5.1.1(iii) Data minimization
+
+1. List sensitive permissions and SDKs.
+2. Compare to app category and metadata promise.
+3. Flag obvious overreach (contacts + photos + location for a calculator).
+
+### 20 — 5.1.1(iv) Permission denial UX
+
+1. Trace location/camera/photo/notification permission flows.
+2. Flag forced loops, dead-ends, or dark patterns after denial.
+
+### 21 — 5.1.2 ATT consistency
+
+1. If ad/attribution SDK or IDFA access: confirm ATT API usage and description text.
+2. Cross-check privacy policy tracking section vs implementation.
+
+### 22 — 5.1.3 HealthKit + ads
+
+1. If HealthKit imported: search for analytics/ad SDK sending health-derived signals.
+2. Flag health data paths combined with advertising identifiers.
+
+### 23 — 5.1.4 Parental gate
+
+1. If kids metadata or child-audience copy: find parental gate before web/links/IAP/account.
+2. Flag child positioning without age gate UI.
+
+### 24 — 5.4 VPN disclosure UI
+
+1. If NetworkExtension/NEVPNManager: search UI strings for data-collection disclosure required at launch/settings.
+2. Flag VPN capability with no user-visible disclosure copy.
+
+### 25 — 5.2.1–5.2.3 IP / trademarks
+
+1. Scan metadata and visible strings for other companies' brands used as if owned.
+2. Flag likely trademark misuse (not generic descriptive use).
+
+### 26 — 5.3.1–5.3.3 Contests
+
+1. If sweepstakes/contest/giveaway language: check for rules, eligibility, sponsor, no-purchase-necessary.
+2. Flag contest marketing without rules in metadata or in-app.
+
+### 27 — 5.6.2–5.6.3 Developer identity
+
+1. Fetch support URL; confirm it resolves and shows developer contact or support path.
+2. Compare app name, support domain, and privacy policy domain for consistency.
+3. Flag placeholder support pages or identity mismatch.
+
+### 28 — 5.6.4–5.6.7 Rating manipulation *(Tier B v1)*
+
+1. Grep Swift and metadata for: `itms-apps://` write-review URLs, `apps.apple.com/.../write-review`,
+   "rate 5 stars", "only enable after review", custom star-rating UI tied to App Store review.
+2. Compare to system `requestReview` / `SKStoreReviewController` usage (scan §25).
+3. Flag dark patterns that manipulate ratings or bypass Apple's review prompt API.
+
+---
+
+## Phase 5 presentation
+
+After Phase 4, include in the final report:
+
+1. Trilingual verdict block (from scan counts only).
+2. Phase 3 commentary (every scan FAIL/WARN).
+3. Phase 4 summary table: 28 checks → count of `REVIEW-FINDING` vs `REVIEW-PASS` (note Tier B items 4, 5, 7, 10, 15, 28 if any fired).
+4. Phase 4 detail: every `REVIEW-FINDING` with Pierre explanation; optionally list `REVIEW-PASS` lines compactly.
+5. Verbatim Phase 1 scan output + verdict/token action.

package/skills/appstore-precheck/scripts/scan.sh

@@ -153,24 +153,28 @@ CHECK_FAMILY="$(cfg_bool '.optionalChecks.familyControls')"
 echo "PASS: layout — ios='${IOS_DIR:-?}' metadata='${META_DIR:-?}' xcstrings='${XCSTRINGS:-?}' locales=${#LOCALES[@]}"
 
 # ===================================================================
-# §1 — 5.1.1(v) Privacy Manifest Required Reason API parity
+# §1 — 5.1.1 Privacy Manifest / Required Reason API parity
+# Apple documents the Required Reason API rules under 5.1.1 (Data Collection and
+# Storage) + the privacy-manifest developer docs; it is NOT roman sub-item (v).
+# (v) "Account Sign-In" is a different rule — its account-deletion requirement is
+# checked separately in §38.
 # ===================================================================
 check_required_reason_api() {
   local cat="$1" pattern="$2" hits declared
   hits=$(grep -rEl "$pattern" "$IOS_DIR" --include="*.swift" 2>/dev/null | head -3)
   declared=$(grep -c "NSPrivacyAccessedAPICategory${cat}" "$PRIVACY_FILE" 2>/dev/null)
   if [[ -n "$hits" && "${declared:-0}" -eq 0 ]]; then
-    fail "5.1.1(v) Required Reason API — '$cat' used in code (e.g. $(echo "$hits" | head -1)) but not declared in PrivacyInfo.xcprivacy"
+    fail "5.1.1 Required Reason API — '$cat' used in code (e.g. $(echo "$hits" | head -1)) but not declared in PrivacyInfo.xcprivacy"
   elif [[ -z "$hits" && "${declared:-0}" -gt 0 ]]; then
-    warn "5.1.1(v) PrivacyInfo — '$cat' declared but no code usage grepped (may be a false positive, verify manually)"
+    warn "5.1.1 PrivacyInfo — '$cat' declared but no code usage grepped (may be a false positive, verify manually)"
   elif [[ -n "$hits" && "${declared:-0}" -gt 0 ]]; then
-    pass "5.1.1(v) Required Reason API — '$cat' parity OK"
+    pass "5.1.1 Required Reason API — '$cat' parity OK"
   fi
 }
 if [[ -z "$IOS_DIR" ]]; then
   warn "layout — could not auto-detect iOS source dir; set .iosSourceDir in $CONFIG"
 elif [[ -z "$PRIVACY_FILE" ]]; then
-  fail "5.1.1(v) PrivacyInfo.xcprivacy not found (required since May 2024 for apps using Required Reason APIs)"
+  fail "5.1.1 Required Reason API — PrivacyInfo.xcprivacy not found (required since May 2024 for apps using Required Reason APIs)"
 else
   check_required_reason_api "UserDefaults"   'UserDefaults|@AppStorage'
   check_required_reason_api "FileTimestamp"  'attributesOfItem|creationDate|modificationDate|\.fileCreationDate|\.fileModificationDate'
@@ -383,13 +387,13 @@ else
 fi
 
 # ===================================================================
-# §12 — 4.0 Minimum functionality — navigation hubs
+# §12 — 4.2 Minimum functionality — navigation hubs
 # ===================================================================
 tab_count=$(grep -rcE 'TabView|NavigationStack|NavigationSplitView' "$IOS_DIR" --include="*.swift" 2>/dev/null | awk -F: '{sum+=$2} END {print sum+0}')
 if (( tab_count < 1 )); then
-  warn "4.0 Minimum functionality — no TabView/NavigationStack found (heuristic, may be a false positive)"
+  warn "4.2 Minimum functionality — no TabView/NavigationStack found (heuristic, may be a false positive)"
 else
-  pass "4.0 Minimum functionality — $tab_count navigation hub(s) found"
+  pass "4.2 Minimum functionality — $tab_count navigation hub(s) found"
 fi
 
 # ===================================================================
@@ -473,8 +477,8 @@ if [[ -d "$META_DIR" ]]; then
     [[ -s "$META_DIR/$loc/privacy_url.txt" ]] && privacy_found=1
   done
   if (( ${#LOCALES[@]} > 0 )); then
-    [[ -z "$support_found" ]] && warn "2.3 Support URL — no non-empty support_url.txt in any locale under fastlane metadata; Apple requires a working support URL"
-    [[ -z "$privacy_found" ]] && warn "2.3 Privacy URL — no non-empty privacy_url.txt in any locale under fastlane metadata; required for apps with accounts or in-app purchases"
+    [[ -z "$support_found" ]] && warn "2.3 Support URL — no non-empty support_url.txt in any locale under fastlane metadata; Apple requires a working support URL with developer contact info (1.5 / 2.3)"
+    [[ -z "$privacy_found" ]] && warn "2.3 Privacy URL — no non-empty privacy_url.txt in any locale under fastlane metadata; a privacy policy link is required for every app, and especially apps with accounts or in-app purchases (5.1.1(i))"
   fi
   url_ph=$(grep -rEnI 'example\.com|localhost|\bTODO\b|\bchangeme\b' "$META_DIR" --include='*_url.txt' 2>/dev/null | grep -v "^Binary file" | head -10)
   if [[ -n "$url_ph" ]]; then
@@ -523,4 +527,309 @@ if [[ -d "$META_DIR" ]]; then
   fi
 fi
 
+# ===================================================================
+# §21 — 3.1.1 Third-party payment SDK for digital goods
+# ===================================================================
+# Apple requires in-app purchase to unlock digital content/functionality. A
+# third-party payment SDK (Stripe, Braintree, PayPal, …) is legitimate for
+# PHYSICAL goods/services but a frequent rejection when used to sell digital
+# content. We can't tell digital from physical statically, so this is advisory.
+if [[ -n "$IOS_DIR" ]]; then
+  payment_sdk=$(grep -rlE 'import Stripe|StripePaymentSheet|StripeApplePay|import Braintree|BTPaymentFlow|import PayPal|PayPalCheckout|PayPalNativeCheckout|import Square|SquareInAppPayments|import Adyen|AdyenComponents|RazorpaySDK|import Paddle' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
+  if [[ -n "$payment_sdk" ]]; then
+    warn "3.1.1 Third-party payment SDK — '$(basename "$payment_sdk")' detected; selling digital content/functionality must use in-app purchase, not an external processor (3.1.1). Allowed only for physical goods/services — verify your offering."
+  fi
+fi
+
+# ===================================================================
+# §22 — 1.2 User-generated content without moderation affordances
+# ===================================================================
+# Apps with UGC must provide: a content filter, a report mechanism, the ability
+# to block abusive users, and published contact info. We detect a UGC signal and
+# warn when no report/block/moderation affordance is found anywhere in the source.
+if [[ -n "$IOS_DIR" ]]; then
+  ugc_signal=$(grep -rlE 'userGeneratedContent|\bUGC\b|StreamChat|MessageKit|SendbirdSDK|PubNub|postComment|submitComment|createPost|publishPost|uploadUserPhoto|uploadVideo' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
+  if [[ -n "$ugc_signal" ]]; then
+    if grep -rqiE 'report(Content|User|Abuse|Post|Comment|Message|Reason|ed)|block(ed)?User|unblockUser|moderat(e|ion|or)|flag(Content|Post|User|Comment|Message)|content.?filter' "$IOS_DIR" --include="*.swift" 2>/dev/null; then
+      pass "1.2 UGC — user-generated content with report/block/moderation affordances present"
+    else
+      warn "1.2 UGC — user-generated content detected (e.g. $(basename "$ugc_signal")) but no report/block/moderation mechanism found; UGC apps must offer content filtering, a report mechanism, user blocking, and published contact info (1.2)"
+    fi
+  fi
+fi
+
+# ===================================================================
+# §23 — 1.6 App Transport Security disabled globally
+# ===================================================================
+# NSAllowsArbitraryLoads=true turns off ATS for the whole app, weakening
+# data-in-transit security and inviting a 1.6 / data-security question at review.
+if [[ -f "$INFO_PLIST" ]]; then
+  if awk '/NSAllowsArbitraryLoads/{getline; if ($0 ~ /<true/) print "ON"}' "$INFO_PLIST" 2>/dev/null | grep -q ON; then
+    warn "1.6 App Transport Security — NSAllowsArbitraryLoads=true in Info.plist disables ATS app-wide; prefer per-domain exceptions, and expect a data-security justification request at review (1.6)"
+  fi
+fi
+
+# ===================================================================
+# §24 — 4.9 Apple Pay recurring-payment disclosure
+# ===================================================================
+# Apps using Apple Pay for recurring payments must disclose the renewal term,
+# what's provided, the charges, and how to cancel. Gated strictly on the Apple
+# Pay recurring API (PKRecurringPaymentRequest) so it does NOT conflate StoreKit
+# auto-renew copy or a one-time PassKit payment with recurring Apple Pay. We don't
+# try to detect the disclosure text (too noisy) — we flag it for manual verify.
+if [[ -n "$IOS_DIR" ]] && grep -rqE 'PKRecurringPaymentRequest' "$IOS_DIR" --include="*.swift" 2>/dev/null; then
+  warn "4.9 Apple Pay — recurring Apple Pay (PKRecurringPaymentRequest) detected; verify you disclose the renewal term, what's provided, the charges, and how to cancel before purchase (4.9)"
+fi
+
+# ===================================================================
+# §25 — 5.6.1 Custom App Store review prompt
+# ===================================================================
+# Apple disallows custom review prompts and direct write-review links — apps must
+# use the system SKStoreReviewController / requestReview API.
+if [[ -n "$IOS_DIR" ]]; then
+  review_link=$(grep -rlE 'write-review|action=write-review|itms-apps[^"]*review' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
+  if [[ -n "$review_link" ]]; then
+    if grep -rqE 'requestReview|SKStoreReviewController|\.requestReview' "$IOS_DIR" --include="*.swift" 2>/dev/null; then
+      pass "5.6.1 App reviews — uses the system requestReview API alongside the review link"
+    else
+      warn "5.6.1 App reviews — a direct App Store review link/prompt was found (e.g. $(basename "$review_link")) but no system requestReview (SKStoreReviewController) call; Apple disallows custom review prompts (5.6.1)"
+    fi
+  fi
+fi
+
+# ===================================================================
+# §26 — 2.3.1 Misleading marketing claims in metadata
+# ===================================================================
+# Marketing the app for things iOS apps can't actually do (virus/malware
+# scanners, fake speed boosters) is a 2.3.1 removal vector.
+if [[ -d "$META_DIR" ]]; then
+  mislead_re='virus scan|virus scanner|antivirus|anti-virus|malware (scan|remov|clean)|spyware remov|clean your (iphone|device)|speed booster|boost.*(speed|ram)|free money|guaranteed.*(win|prize)'
+  mislead_hits=$(grep -rEniI "$mislead_re" "$META_DIR" 2>/dev/null | grep -v "^Binary file" | head -10)
+  if [[ -n "$mislead_hits" ]]; then
+    warn "2.3.1 Misleading marketing — claims that often violate 2.3.1 (e.g. iOS virus/malware scanners, fake speed boosters) in metadata; verify the app truly delivers them or remove the claim:"
+    echo "$mislead_hits" | sed 's/^/      /'
+  fi
+fi
+
+# ===================================================================
+# §27 — 2.3.8 "For Kids/Children" wording outside the Kids Category
+# ===================================================================
+# Terms implying a child audience in name/subtitle/keywords/description are
+# reserved for the Kids Category (2.3.8 / 5.1.4).
+if [[ -d "$META_DIR" ]]; then
+  kids_re='for kids|for children|for your (kid|child)|kids[[:space:]]?app|für kinder|para niños|pour enfants'
+  kids_hits=$(grep -rEniI "$kids_re" "$META_DIR" 2>/dev/null | grep -v "^Binary file" | head -10)
+  if [[ -n "$kids_hits" ]]; then
+    warn "2.3.8 'For Kids/Children' wording — terms implying a child audience are reserved for the Kids Category (2.3.8); if not enrolled, remove them from name/subtitle/keywords/description:"
+    echo "$kids_hits" | sed 's/^/      /'
+  fi
+fi
+
+# ===================================================================
+# §28 — 4.4.1 Keyboard extension requiring full access
+# ===================================================================
+# Keyboards must stay functional without full network access / "full access",
+# and may only collect data to enhance the keyboard.
+kb_plist=$(grep -rlE 'com\.apple\.keyboard-service' --include='Info.plist' "${GREP_PRUNE[@]}" . 2>/dev/null | pick_shallowest)
+if [[ -n "$kb_plist" ]]; then
+  if grep -A1 'RequestsOpenAccess' "$kb_plist" 2>/dev/null | grep -q '<true'; then
+    warn "4.4.1 Keyboard extension — RequestsOpenAccess=true in $kb_plist; keyboards must remain functional without full access and may only collect data to enhance the keyboard (4.4.1). Justify full access in your review notes."
+  else
+    pass "4.4.1 Keyboard extension — present without requiring full access"
+  fi
+fi
+
+# ===================================================================
+# §29 — 5.1.3 Health data with an iCloud sync path
+# ===================================================================
+# Personal health information must not be stored in iCloud, and HealthKit data
+# may not be used for advertising/marketing.
+if [[ -n "$IOS_DIR" ]] && grep -rqE 'import HealthKit|HKHealthStore' "$IOS_DIR" --include="*.swift" 2>/dev/null; then
+  if grep -rqE 'import CloudKit|CKRecord|CKContainer|NSUbiquitousKeyValueStore|NSUbiquitousContainer' "$IOS_DIR" --include="*.swift" 2>/dev/null; then
+    warn "5.1.3 Health data — HealthKit and iCloud/CloudKit are both used; personal health information must not be stored in iCloud (5.1.3). Verify HealthKit data is not synced to iCloud."
+  else
+    pass "5.1.3 Health data — HealthKit used without an obvious iCloud sync path"
+  fi
+fi
+
+# ===================================================================
+# §30 — 5.4 VPN apps (NetworkExtension)
+# ===================================================================
+# VPN apps must be offered by an organization account, declare data collection
+# on-screen before use, and may not sell/share data.
+if [[ -n "$IOS_DIR" ]]; then
+  vpn_use=$(grep -rlE 'NEVPNManager|NETunnelProviderManager|NEPacketTunnelProvider|NEVPNProtocol' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
+  if [[ -n "$vpn_use" ]]; then
+    warn "5.4 VPN — NetworkExtension/NEVPNManager usage detected (e.g. $(basename "$vpn_use")); VPN apps must be offered by an organization account, disclose data collection on-screen before use, and not sell/share data (5.4). Verify compliance."
+  fi
+fi
+
+# ===================================================================
+# §31 — 2.1 Demo account for a credential login
+# ===================================================================
+# Apps behind a login must give App Review working credentials (a demo account
+# or notes). We fire only on a credential-login signal (a password field or a
+# Login/SignIn view), then look for demo creds in fastlane review_information or
+# the reviewer-prep notes. Social-only logins are not gated here (too noisy).
+if [[ -n "$IOS_DIR" ]]; then
+  auth_signal=$(grep -rlE 'SecureField' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
+  [[ -z "$auth_signal" ]] && auth_signal=$(find "$IOS_DIR" "${PRUNE[@]}" \( -name '*Login*View*.swift' -o -name '*SignIn*View*.swift' \) 2>/dev/null | head -1)
+  if [[ -n "$auth_signal" ]]; then
+    demo_present=""
+    ri="$META_DIR/review_information"
+    if [[ -d "$ri" ]]; then
+      for f in demo_user.txt demo_password.txt notes.txt; do [[ -s "$ri/$f" ]] && demo_present=1; done
+    fi
+    if [[ -z "$demo_present" && -n "$REVIEW_PREP" && -f "$REVIEW_PREP" ]]; then
+      grep -qiE 'demo|review.*(account|credential)|test.*account' "$REVIEW_PREP" 2>/dev/null && demo_present=1
+    fi
+    if [[ -n "$demo_present" ]]; then
+      pass "2.1 Demo account — credential login present and reviewer demo credentials/notes found"
+    else
+      warn "2.1 Demo account — a credential login was detected (e.g. $(basename "$auth_signal")) but no demo account/credentials for App Review found (fastlane review_information or .reviewPrepNotes); apps behind a login must give reviewers working credentials (2.1)"
+    fi
+  fi
+fi
+
+# ===================================================================
+# §32 — 2.5.2 Executable code download / hot-patch
+# ===================================================================
+# Apps must be self-contained; native hot-patching frameworks (JSPatch, Rollout,
+# DynamicCocoa) download code that changes features and are a removal vector.
+# JS-bundle OTA for React Native (CodePush) is allowed, so we do NOT flag it.
+if [[ -n "$IOS_DIR" ]]; then
+  hotcode=$(grep -rlE 'import JSPatch|JSPatch\.|[Jj][Ss][Pp]atch|import Rollout|Rollout\.|rollout\.io|DynamicCocoa|import SwiftPatch' "$IOS_DIR" --include="*.swift" --include="*.m" --include="*.h" 2>/dev/null | head -1)
+  if [[ -n "$hotcode" ]]; then
+    warn "2.5.2 Executable code — a hot-patch / remote-code framework was detected (e.g. $(basename "$hotcode")); apps may not download or run code that changes features (JSPatch/Rollout-style native hot-patching). Allowed JS-bundle OTA (e.g. React Native CodePush) is fine — verify this is not native hot-patching (2.5.2)"
+  fi
+fi
+
+# ===================================================================
+# §33 — 2.5.4 Background modes declared but unused
+# ===================================================================
+# Declare only the UIBackgroundModes the app actually uses; a mode declared with
+# no matching API is a frequent rejection. We parse the array and check each
+# declared mode against its framework/API in Swift.
+if [[ -f "$INFO_PLIST" && -n "$IOS_DIR" ]]; then
+  modes=$(awk '/<key>UIBackgroundModes<\/key>/{f=1;next} f&&/<\/array>/{f=0} f&&/<string>/{gsub(/.*<string>|<\/string>.*/,""); print}' "$INFO_PLIST" 2>/dev/null)
+  if [[ -n "$modes" ]]; then
+    unused=""
+    while IFS= read -r m; do
+      [[ -z "$m" ]] && continue
+      case "$m" in
+        location) grep -rqE 'CLLocationManager|CoreLocation' "$IOS_DIR" --include="*.swift" 2>/dev/null || unused="$unused location" ;;
+        audio) grep -rqE 'AVAudioSession|AVPlayer|AVAudioPlayer|AVQueuePlayer|AVAudioEngine' "$IOS_DIR" --include="*.swift" 2>/dev/null || unused="$unused audio" ;;
+        voip) grep -rqE 'PushKit|PKPushRegistry|CallKit|CXProvider' "$IOS_DIR" --include="*.swift" 2>/dev/null || unused="$unused voip" ;;
+        fetch) grep -rqE 'BGAppRefreshTask|BackgroundTasks|setMinimumBackgroundFetchInterval|performFetchWithCompletionHandler' "$IOS_DIR" --include="*.swift" 2>/dev/null || unused="$unused fetch" ;;
+        processing) grep -rqE 'BGProcessingTask|BackgroundTasks' "$IOS_DIR" --include="*.swift" 2>/dev/null || unused="$unused processing" ;;
+        bluetooth-central|bluetooth-peripheral) grep -rqE 'CoreBluetooth|CBCentralManager|CBPeripheralManager' "$IOS_DIR" --include="*.swift" 2>/dev/null || unused="$unused $m" ;;
+        remote-notification) grep -rqE 'didReceiveRemoteNotification|UNUserNotificationCenter|registerForRemoteNotifications' "$IOS_DIR" --include="*.swift" 2>/dev/null || unused="$unused remote-notification" ;;
+      esac
+    done <<< "$modes"
+    if [[ -n "$unused" ]]; then
+      warn "2.5.4 Background modes —$unused declared in UIBackgroundModes but no matching API usage found in Swift; declare only the background modes the app actually uses (2.5.4)"
+    else
+      pass "2.5.4 Background modes — declared modes have matching API usage"
+    fi
+  fi
+fi
+
+# ===================================================================
+# §34 — 3.1.5(a) Cryptocurrency wallet / exchange / mining
+# ===================================================================
+if [[ -n "$IOS_DIR" ]]; then
+  crypto_sdk=$(grep -rlE 'import Web3|web3swift|Web3Swift|WalletConnect|TrustWalletCore|CoinbaseWalletSDK|SolanaSwift|CryptoMining|coinhive|MoneroMiner' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
+  if [[ -n "$crypto_sdk" ]]; then
+    warn "3.1.5(a) Cryptocurrency — a crypto wallet/exchange/mining signal was detected (e.g. $(basename "$crypto_sdk")); wallets & exchanges have entity and licensing requirements, and on-device mining is not permitted (3.1.5(a)). Verify eligibility."
+  fi
+fi
+
+# ===================================================================
+# §35 — 4.2.3 Web-wrapper / thin app
+# ===================================================================
+# A thin WKWebView wrapper around a website is rejected under minimum
+# functionality. Heuristic: WKWebView present in a project with very few Swift
+# files. WARN (verify) — this is the most false-positive-prone of the batch.
+if [[ -n "$IOS_DIR" ]]; then
+  if grep -rqE 'WKWebView' "$IOS_DIR" --include="*.swift" 2>/dev/null; then
+    swift_n=$(find "$IOS_DIR" "${PRUNE[@]}" -name '*.swift' 2>/dev/null | wc -l | tr -d ' ')
+    if (( swift_n > 0 && swift_n <= 4 )); then
+      warn "4.2.3 Minimum functionality — the app appears to be a WKWebView wrapper with only $swift_n Swift file(s); a thin wrapper around a website is rejected under 4.2.3. Add native value, or verify this is a real app rather than a repackaged site."
+    fi
+  fi
+fi
+
+# ===================================================================
+# §36 — 4.2.7 Remote desktop / host-mirroring
+# ===================================================================
+if [[ -n "$IOS_DIR" ]]; then
+  remote_desktop=$(grep -rlE 'import libvncclient|LibVNC|VNCClient|RDPSession|RDPKit|RemoteDesktopClient|import FreeRDP|JumpDesktop' "$IOS_DIR" --include="*.swift" --include="*.m" 2>/dev/null | head -1)
+  if [[ -n "$remote_desktop" ]]; then
+    warn "4.2.7 Remote desktop — a remote-desktop/mirroring signal was detected (e.g. $(basename "$remote_desktop")); host-mirroring apps must only show/control the owner's host, display host content (not App Store content), and be free or use IAP (4.2.7). Verify."
+  fi
+fi
+
+# ===================================================================
+# §37 — 4.4.2 Safari extension / content blocker
+# ===================================================================
+safari_ext=$(grep -rlE 'com\.apple\.Safari\.(content-blocker|web-extension|extension)' --include='Info.plist' "${GREP_PRUNE[@]}" . 2>/dev/null | pick_shallowest)
+if [[ -n "$safari_ext" ]]; then
+  warn "4.4.2 Safari extension — a Safari content-blocker / web extension was detected ($safari_ext); it must use the extension APIs as intended, do only what it declares, and not include hidden analytics/ads or track without consent (4.4.2). Verify."
+fi
+
+# ===================================================================
+# §38 — 5.1.1(v) Account Sign-In: account creation without in-app deletion
+# ===================================================================
+# Apple 5.1.1(v): apps that support account creation must also let users delete
+# their account from within the app. Detect account-creation signals, then look
+# for an in-app deletion path. Deletion via a web page is missed → WARN, not FAIL.
+if [[ -n "$IOS_DIR" ]]; then
+  signup=$(grep -rlE 'createUser|signUp|signup|createAccount|registerUser|registerNewUser|Auth\.auth\(\)\.createUser' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
+  if [[ -n "$signup" ]]; then
+    if grep -rqiE 'delete.?account|account.?deletion|closeAccount|deleteUser|removeAccount|deleteMyAccount' "$IOS_DIR" --include="*.swift" 2>/dev/null; then
+      pass "5.1.1(v) Account deletion — account creation present and an in-app account-deletion path was found"
+    else
+      warn "5.1.1(v) Account deletion — account creation was detected (e.g. $(basename "$signup")) but no in-app account-deletion path found; apps that support account creation must let users delete their account from within the app (5.1.1(v))"
+    fi
+  fi
+fi
+
+# ===================================================================
+# §39 — 5.1.4 Kids audience with third-party ads / analytics
+# ===================================================================
+# Kids Category apps may not include third-party advertising or analytics and
+# must include a parental gate. We fire when the metadata targets a child
+# audience AND an ad/analytics SDK is linked. tracking_sdk/analytics_sdk come
+# from §3/§19.
+if [[ -d "$META_DIR" && -n "$IOS_DIR" ]]; then
+  if grep -rqEiI 'for kids|for children|kids[[:space:]]?app|für kinder|para niños|pour enfants' "$META_DIR" 2>/dev/null; then
+    if [[ -n "$tracking_sdk" || -n "$analytics_sdk" ]]; then
+      warn "5.1.4 Kids — the metadata targets a child audience and a third-party ads/analytics SDK is linked (e.g. $(basename "${tracking_sdk:-$analytics_sdk}")); Kids Category apps may not include third-party advertising or analytics and must offer a parental gate (5.1.4)"
+    fi
+  fi
+fi
+
+# ===================================================================
+# §40 — 5.3.4 Real-money gambling
+# ===================================================================
+if [[ -d "$META_DIR" ]]; then
+  gamble_re='real[ -]?money|gambling|casino|sportsbook|sports[ -]?betting|place[ -].*bets|wager(ing)?|roulette.*real'
+  gamble_hits=$(grep -rEniI "$gamble_re" "$META_DIR" 2>/dev/null | grep -v "^Binary file" | head -10)
+  if [[ -n "$gamble_hits" ]]; then
+    warn "5.3.4 Gambling — real-money gaming language in metadata; real-money gambling/lotteries need the proper licenses, must be geo-restricted to permitted regions, and must be free on the App Store (5.3.4):"
+    echo "$gamble_hits" | sed 's/^/      /'
+  fi
+fi
+
+# ===================================================================
+# §41 — 5.5 Mobile Device Management
+# ===================================================================
+if [[ -n "$IOS_DIR" ]]; then
+  mdm_sig=$(grep -rlE 'import DeviceManagement|MDMConfiguration|ManagedAppConfiguration|com\.apple\.mdm' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
+  [[ -z "$mdm_sig" ]] && mdm_sig=$(grep -rlE 'com\.apple\.configuration\.managed' --include='*.plist' "${GREP_PRUNE[@]}" . 2>/dev/null | pick_shallowest)
+  if [[ -n "$mdm_sig" ]]; then
+    warn "5.5 MDM — a Mobile Device Management signal was detected (e.g. $(basename "$mdm_sig")); MDM apps require a commercial enterprise/education entity, may request the MDM capability only for that purpose, and must not sell or use the data for other ends (5.5). Verify eligibility."
+  fi
+fi
+
 echo "---END-OF-SCAN---"