plugin: add Apple Developer provisioning workflow

ROADMAP.md

@@ -759,6 +759,7 @@ Completed Milestone 23 by adding the `cloud-inference-skills` child plugin, ship
 - [ ] Investigate further standardization and automation for shared skill scaffolding, evidence capture, validation prompts, and generated references so common workflow knowledge is maintained once and reused with lower token load.
 - [ ] Redesign the Socket release flow around branch-backed worktrees. Split pre-merge feature-branch gates from post-merge `main` gates, make the release-ready failure mode more helpful when run from a worktree, preserve the rule that tags and release evidence come from reviewed `main`, and document how a release-prep branch should carry version bumps without making the base checkout dirty.
 - [ ] Centralize Socket validation behind one root command before adding more plugin-specific validators. The first pass should gather marketplace metadata, plugin manifests, icon assets, child `AGENTS.md`, `SKILL.md` frontmatter, `agents/openai.yaml`, shared version inventory, release-prep checks, and optional child-local tests into a clear report while keeping heavyweight behavior tests opt-in.
+- [ ] Add a future Apple Developer Portal Driver for accessible, interactive portal-only provisioning tasks. Keep Apple authentication, two-factor authentication, account/team selection, and destructive operations behind explicit user-visible confirmation gates; retain official App Store Connect REST, Xcode-aware discovery, `cktool`, and CKTool JS as the primary surfaces, and do not automate unsupported portal forms until a reviewed driver design exists.
 
 ## Backlog Candidates
 

plugins/apple-dev-skills/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "apple-dev-skills",
   "version": "8.7.0",
-  "description": "Apple development workflows for Codex, including SwiftData, SwiftUI architecture, media and audio repair, XcodeGen migration, Xcode coding intelligence, Core Animation, typography, SF Symbols, AppKit, Safari, DeviceCheck/App Attest, Swift OpenAPI clients, and DocC.",
+  "description": "Apple development workflows for Codex, including Apple Developer provisioning and CloudKit automation planning, SwiftData, SwiftUI architecture, media and audio repair, XcodeGen migration, Xcode coding intelligence, Core Animation, typography, SF Symbols, AppKit, Safari, DeviceCheck/App Attest, Swift OpenAPI clients, and DocC.",
   "author": {
     "name": "Gale",
     "email": "mail@galewilliams.com",
@@ -39,6 +39,10 @@
     "app-attest",
     "attestation",
     "fraud-risk",
+    "provisioning",
+    "app-store-connect",
+    "cloudkit",
+    "cktool",
     "openapi",
     "urlsession",
     "ios",
@@ -69,6 +73,7 @@
       "Help me design and preview an Apple app icon using Icon Composer, local Mac artwork tools, ictool exports, and careful Computer Use guidance for the GUI.",
       "Choose the right Safari extension, Safari Web Inspector, SafariServices, messaging, content blocker, or automation fallback path for this Mac app.",
       "Design a DeviceCheck or App Attest flow for this Apple app, keeping DCDevice, DCAppAttestService, server challenges, entitlements, rollout, and backend validation handoffs explicit.",
+      "Plan safe Apple Developer provisioning or CloudKit automation using official App Store Connect REST APIs, Xcode-aware discovery, cktool, or CKTool JS; keep credentials local, show a dry run first, and route portal-only configuration to the Apple Developer Portal.",
       "Add or diagnose a generated Swift OpenAPI client in this Apple app using OpenAPIURLSession and current Apple docs.",
       "Help me build, test, or debug this Swift or Xcode project using the repo's Apple workflows.",
       "Design, migrate, test, or integrate SwiftData persistence using the dedicated SwiftData workflow and current Apple documentation.",

plugins/apple-dev-skills/.github/scripts/sync_shared_snippets.sh

@@ -67,6 +67,7 @@ sync_one \
   "$ROOT_DIR/skills/swiftui-animation-workflow/references/snippets/apple-xcode-project-core.md" \
   "$ROOT_DIR/skills/safari-extension-control-workflow/references/snippets/apple-xcode-project-core.md" \
   "$ROOT_DIR/skills/devicecheck-app-attest-workflow/references/snippets/apple-xcode-project-core.md" \
+  "$ROOT_DIR/skills/apple-developer-provisioning-workflow/references/snippets/apple-xcode-project-core.md" \
   "$ROOT_DIR/skills/swiftui-app-architecture-workflow/references/snippets/apple-xcode-project-core.md" \
   "$ROOT_DIR/skills/appkit-app-architecture-workflow/references/snippets/apple-xcode-project-core.md" \
   "$ROOT_DIR/skills/sync-xcode-project-guidance/references/snippets/apple-xcode-project-core.md" \

plugins/apple-dev-skills/.github/scripts/validate_repo_docs.sh

@@ -124,6 +124,7 @@ active_skill_mds=(
   "./skills/swiftui-animation-workflow/SKILL.md"
   "./skills/safari-extension-control-workflow/SKILL.md"
   "./skills/devicecheck-app-attest-workflow/SKILL.md"
+  "./skills/apple-developer-provisioning-workflow/SKILL.md"
   "./skills/appkit-app-architecture-workflow/SKILL.md"
   "./skills/swiftui-app-architecture-workflow/SKILL.md"
   "./skills/swiftdata-workflow/SKILL.md"
@@ -138,7 +139,7 @@ active_skill_mds=(
   "./skills/sync-swift-package-guidance/SKILL.md"
   "./skills/xcode-coding-intelligence-workflow/SKILL.md"
 )
-[[ ${#active_skill_mds[@]} -eq 31 ]] || fail "Expected exactly 31 active skills, found ${#active_skill_mds[@]}."
+[[ ${#active_skill_mds[@]} -eq 32 ]] || fail "Expected exactly 32 active skills, found ${#active_skill_mds[@]}."
 
 shared_xcode_snippet="./shared/agents-snippets/apple-xcode-project-core.md"
 shared_package_snippet="./shared/agents-snippets/apple-swift-package-core.md"

plugins/apple-dev-skills/README.md

@@ -1,6 +1,6 @@
 # apple-dev-skills
 
-Apple, Swift, SwiftUI animation and architecture, Core Animation, Apple typography, SF Symbols, AppKit, Icon Composer app icons, Safari, DeviceCheck, App Attest, Xcode, Swift OpenAPI client, DocC, and `Dash.app` workflows for Codex.
+Apple, Swift, SwiftUI animation and architecture, Core Animation, Apple typography, SF Symbols, AppKit, Apple Developer provisioning, CloudKit, Icon Composer app icons, Safari, DeviceCheck, App Attest, Xcode, Swift OpenAPI client, DocC, and `Dash.app` workflows for Codex.
 
 ![Codex plugin directory filtered to the Socket marketplace, showing Apple Dev Skills listed alongside companion plugins below a Productivity Skills suggestion.](./docs/media/codex-plugin-directory-socket-apple-dev-skills.png)
 
@@ -73,6 +73,7 @@ Use Apple Dev Skills when an agent is helping with:
 - Icon Composer app icon design, preview, and Xcode handoff
 - Safari extension and SafariServices integration choices
 - DeviceCheck per-device state and App Attest app-integrity flow planning
+- Safe official App Store Connect provisioning and CloudKit automation planning, with explicit Apple Developer Portal fallbacks
 - Swift OpenAPI client generation and `URLSession` transport integration
 - Swift package bootstrap, build, and testing
 - Apple UI accessibility work
@@ -140,6 +141,7 @@ uv run pytest
 - `core-animation-layer-workflow`
 - `coremedia-timing-samplebuffer-workflow`
 - `devicecheck-app-attest-workflow`
+- `apple-developer-provisioning-workflow`
 - `explore-apple-swift-docs`
 - `format-swift-sources`
 - `icon-composer-app-icon-workflow`

plugins/apple-dev-skills/ROADMAP.md

@@ -30,6 +30,7 @@ Swift naming and persistence ownership are now standardized: each project explic
 - [Milestone 50: Swift Lang Handoff And Compatibility](#milestone-50-swift-lang-handoff-and-compatibility)
 - [Milestone 52: Apple Design Animation And Symbols Workflow Skills](#milestone-52-apple-design-animation-and-symbols-workflow-skills)
 - [Milestone 53: DeviceCheck and App Attest Workflow](#milestone-53-devicecheck-and-app-attest-workflow)
+- [Milestone 54: Apple Developer Provisioning and CloudKit Workflow](#milestone-54-apple-developer-provisioning-and-cloudkit-workflow)
 - [Backlog Candidates](#backlog-candidates)
 - [History](#history)
 
@@ -71,6 +72,7 @@ Swift naming and persistence ownership are now standardized: each project explic
 - Milestone 50: Swift Lang Handoff And Compatibility - In Progress
 - Milestone 52: Apple Design Animation And Symbols Workflow Skills - In Progress
 - Milestone 53: DeviceCheck and App Attest Workflow - Completed
+- Milestone 54: Apple Developer Provisioning and CloudKit Workflow - Completed
 
 ## Milestone 21: Swift Cleanup Automation Exploration
 
@@ -766,6 +768,27 @@ Completed
 
 Completed Milestone 53 by adding `devicecheck-app-attest-workflow`, focused references for DeviceCheck state, App Attest client flow, server validation, and App ID/entitlement validation, plus plugin metadata, README inventory, shared snippet coverage, customization contract files, and targeted tests for routing, docs gates, and handoffs.
 
+## Milestone 54: Apple Developer Provisioning and CloudKit Workflow
+
+### Status
+
+Completed
+
+### Scope
+
+- [x] Add a docs-first workflow for the official App Store Connect REST provisioning surface, Xcode-aware discovery, `cktool`, and CKTool JS.
+- [x] Make team-key requirements, individual-key limits, Keychain/local-secret handling, short-lived JWTs, dry runs, and explicit mutation confirmation mandatory.
+- [x] Keep App Groups, CloudKit container registration/assignment, Service IDs, and other undocumented configuration visibly portal-only.
+- [x] Record the future interactive Apple Developer Portal Driver separately from the shipped official-API workflow.
+
+### Exit Criteria
+
+- [x] Apple Dev Skills ships `apple-developer-provisioning-workflow` with official and portal-only paths clearly separated.
+- [x] The skill documents CloudKit management-token setup and safe `cktool` / CKTool JS boundaries without committing secrets.
+- [x] Plugin metadata, README inventory, validator, and focused tests agree on the added skill.
+
+Completed Milestone 54 by shipping `apple-developer-provisioning-workflow` with plan-first App Store Connect provisioning, local Xcode discovery handoffs, Keychain-backed CloudKit guidance, account/key prerequisites, and explicit portal-only fallbacks.
+
 ## Backlog Candidates
 
 - [ ] Record plausible future work that is not yet committed to a milestone.

plugins/apple-dev-skills/docs/maintainers/customization-consolidation-review.md

@@ -8,8 +8,8 @@ Record the Milestone 20 audit of the current customization system, decide whethe
 
 ## Current State Summary
 
-- The active skill surface ships `31` separate `references/customization.template.yaml` files.
-- The active skill surface ships `31` separate `scripts/customization_config.py` entrypoints.
+- The active skill surface ships `32` separate `references/customization.template.yaml` files.
+- The active skill surface ships `32` separate `scripts/customization_config.py` entrypoints.
 - Those `customization_config.py` files are functionally identical and exist only because installed skills are expected to keep runtime resources inside the skill directory.
 - The current templates expose `21` knobs total:
   - `20` are documented as `runtime-enforced`
@@ -30,7 +30,7 @@ Milestone 20 audited a larger surface before the implementation pass landed.
 - Milestone 27 applied the approved reduction so the live surface now reflects the smaller counts in the current-state summary above.
 - Milestone 38 later added the narrower `author-swift-docc-docs` skill with one runtime-enforced tutorial-handling knob, which is included in the current-state counts above.
 - The current-state counts also include `structure-swift-sources`, which now ships runtime-enforced header-policy and split-threshold knobs for the structural-cleanup workflow.
-- The current-state counts now also include the no-runtime-knob `apple-ui-accessibility-workflow`, `safari-extension-control-workflow`, `devicecheck-app-attest-workflow`, `swiftui-app-architecture-workflow`, `swiftui-animation-workflow`, `sf-symbols-workflow`, `core-animation-layer-workflow`, `apple-typography-workflow`, `appkit-app-architecture-workflow`, `xcode-coding-intelligence-workflow`, `migrate-xcode-project-to-xcodegen`, `avfaudio-session-workflow`, `avaudio-engine-workflow`, `avfoundation-media-pipeline-workflow`, `coremedia-timing-samplebuffer-workflow`, and `coreaudio-modernization-repair-workflow` surfaces, all of which keep the customization-file contract without introducing runtime knobs.
+- The current-state counts now also include the no-runtime-knob `apple-ui-accessibility-workflow`, `safari-extension-control-workflow`, `devicecheck-app-attest-workflow`, `apple-developer-provisioning-workflow`, `swiftui-app-architecture-workflow`, `swiftui-animation-workflow`, `sf-symbols-workflow`, `core-animation-layer-workflow`, `apple-typography-workflow`, `appkit-app-architecture-workflow`, `xcode-coding-intelligence-workflow`, `migrate-xcode-project-to-xcodegen`, `avfaudio-session-workflow`, `avaudio-engine-workflow`, `avfoundation-media-pipeline-workflow`, `coremedia-timing-samplebuffer-workflow`, and `coreaudio-modernization-repair-workflow` surfaces, all of which keep the customization-file contract without introducing runtime knobs.
 
 ## Decision