From 8dee3c2b23da6651b967d28e055459cb216828f0 Mon Sep 17 00:00:00 2001 From: Sinabina Date: Fri, 24 Jul 2026 10:08:55 -0700 Subject: [PATCH 1/3] fix(gstack2): restore ban on browser-driven credential creation Lost in the v1.64.7.0 compression. Legal ASP fallback: verbatim error, in-session masked keychain add, retry. No Aside for credentials, ever. Co-Authored-By: Claude Fable 5 --- scripts/gstack2/generate-skill-tree.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/gstack2/generate-skill-tree.ts b/scripts/gstack2/generate-skill-tree.ts index 45fb40544f..23941e4bf8 100644 --- a/scripts/gstack2/generate-skill-tree.ts +++ b/scripts/gstack2/generate-skill-tree.ts @@ -674,7 +674,7 @@ Build this question's options from a LIVE check of installed skills at ask time 1. Archive and export the signed Release build with \`gym\` (it drives xcodebuild and the signing minted in preflight). Projects with custom archive requirements may drop to \`xcodebuild archive\` directly; the output either way is an App Store-signed \`.ipa\`. 2. The upload is an external effect: run \`pilot\` (TestFlight) or \`deliver\` (App Store) through the durable state wrapper with a key like \`appstore.upload..\`. Never re-upload on ambiguity; inspect App Store Connect for the build first. 3. The cached session is an env-level credential: never argv, never echoed, never committed. -4. NEVER demand an app-specific password. Per fastlane's documented authentication, the cached spaceauth session ALONE suffices for binary upload through \`deliver\`/\`pilot\`; \`FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD\` is an alternative for environments without a session, not a requirement on top of one. Attempt the session upload FIRST; only an actual authentication error from a real upload attempt may open a fallback conversation, and "Apple requires an app-specific password on 2FA accounts" stated without that error in hand is a contract violation. +4. NEVER demand an app-specific password. Per fastlane's documented authentication, the cached spaceauth session ALONE suffices for binary upload through \`deliver\`/\`pilot\`; \`FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD\` is an alternative for environments without a session, not a requirement on top of one. Attempt the session upload FIRST; only an actual authentication error from a real upload attempt may open a fallback conversation, and "Apple requires an app-specific password on 2FA accounts" stated without that error in hand is a contract violation. When a real error does force the fallback, QUOTE the error verbatim, and the only offered path is self-service: the user generates the password on any device and enters it through the host's in-session masked prompt into the macOS keychain (\`fastlane fastlane-credentials add --username \`), then the upload is retried. NEVER offer or recommend a browser drive to create credentials — no Aside, no agentic browser, for any password, key, or token, under any framing. 5. App Review contact details (name, email, phone) are required metadata for submission: infer name and email from the signed-in Apple ID and git config, collect the phone number once inside the authorization moment, persist it to the decision store, and never re-ask. Contact details are metadata, not a blocking gate to announce mid-run. ## Storefront completion From b9e73ff438d3a66a3aa045596fc92913291a5811 Mon Sep 17 00:00:00 2001 From: Sinabina Date: Fri, 24 Jul 2026 10:08:55 -0700 Subject: [PATCH 2/3] chore(gstack2): regenerate Apple release adapter Co-Authored-By: Claude Fable 5 --- skills/ship/references/APPLE-RELEASE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/skills/ship/references/APPLE-RELEASE.md b/skills/ship/references/APPLE-RELEASE.md index d5d7add1f4..595d45a830 100644 --- a/skills/ship/references/APPLE-RELEASE.md +++ b/skills/ship/references/APPLE-RELEASE.md @@ -37,7 +37,7 @@ Build this question's options from a LIVE check of installed skills at ask time 1. Archive and export the signed Release build with `gym` (it drives xcodebuild and the signing minted in preflight). Projects with custom archive requirements may drop to `xcodebuild archive` directly; the output either way is an App Store-signed `.ipa`. 2. The upload is an external effect: run `pilot` (TestFlight) or `deliver` (App Store) through the durable state wrapper with a key like `appstore.upload..`. Never re-upload on ambiguity; inspect App Store Connect for the build first. 3. The cached session is an env-level credential: never argv, never echoed, never committed. -4. NEVER demand an app-specific password. Per fastlane's documented authentication, the cached spaceauth session ALONE suffices for binary upload through `deliver`/`pilot`; `FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD` is an alternative for environments without a session, not a requirement on top of one. Attempt the session upload FIRST; only an actual authentication error from a real upload attempt may open a fallback conversation, and "Apple requires an app-specific password on 2FA accounts" stated without that error in hand is a contract violation. +4. NEVER demand an app-specific password. Per fastlane's documented authentication, the cached spaceauth session ALONE suffices for binary upload through `deliver`/`pilot`; `FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD` is an alternative for environments without a session, not a requirement on top of one. Attempt the session upload FIRST; only an actual authentication error from a real upload attempt may open a fallback conversation, and "Apple requires an app-specific password on 2FA accounts" stated without that error in hand is a contract violation. When a real error does force the fallback, QUOTE the error verbatim, and the only offered path is self-service: the user generates the password on any device and enters it through the host's in-session masked prompt into the macOS keychain (`fastlane fastlane-credentials add --username `), then the upload is retried. NEVER offer or recommend a browser drive to create credentials — no Aside, no agentic browser, for any password, key, or token, under any framing. 5. App Review contact details (name, email, phone) are required metadata for submission: infer name and email from the signed-in Apple ID and git config, collect the phone number once inside the authorization moment, persist it to the decision store, and never re-ask. Contact details are metadata, not a blocking gate to announce mid-run. ## Storefront completion From 0a9d16e76a837475004343f03c47764a092d1a20 Mon Sep 17 00:00:00 2001 From: Sinabina Date: Fri, 24 Jul 2026 10:08:55 -0700 Subject: [PATCH 3/3] docs: CHANGELOG + VERSION 1.64.14.0 Co-Authored-By: Claude Fable 5 --- CHANGELOG.md | 12 ++++++++++++ VERSION | 2 +- package.json | 2 +- 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4b054f4479..954dd63c91 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,18 @@ > completion state and remaining P0 gates. No version bump or release claim is > made here while that status holds. +## [1.64.14.0] - 2026-07-24 + +**Credentials are never created by a browser drive. Restored, permanently.** + +The v1.64.7.0 contract compression dropped the explicit ban on browser-driven credential creation, and a release run promptly recommended driving account.apple.com to mint an app-specific password. The ban is back, wider: no Aside, no agentic browser, for any password, key, or token, under any framing. When a genuine upload auth error forces the app-specific-password fallback, the error is quoted verbatim and the only path offered is self-service — generate it on any device, enter it through the in-session masked keychain prompt, retry. + +### Itemized changes + +### Changed + +- `references/APPLE-RELEASE.md` (ship tree): browser-driven credential creation banned again explicitly; legal fallback shape defined (verbatim error + in-session masked `fastlane fastlane-credentials add` + retry). + ## [1.64.13.0] - 2026-07-24 **The session is enough. Demanding an app-specific password is a bug.** diff --git a/VERSION b/VERSION index 4db9fa1e43..757d71ccdb 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.64.13.0 +1.64.14.0 diff --git a/package.json b/package.json index 543ad0e0b9..74471e27e8 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "gstack", - "version": "1.64.13.0", + "version": "1.64.14.0", "description": "GStack 2 \u2014 six portable Agent Skills with an optional host-neutral runtime.", "license": "MIT", "type": "module",