Repository navigation
docs(agents): close out release-session plans; absorb remaining process notes - #38
Conversation
…ss notes
The three release-session plan files in .agents/plans/ were mostly
stale: every shipped code finding from them is already on development.
Close them out by checking items against the current tree, and move
the few still-useful notes into AGENTS.md so future sessions don't
have to dig through three plan files to find them.
Plan-by-plan:
* klepon (token-source + builds API): all scope items landed. Unit
tests for token.rs (CountingSource in crates/core/src/client.rs,
StaticToken / boxed source in crates/core/src/token.rs) cover the
'Client::new over a custom TokenSource' gap; the MCP list_builds
tool already constructs BuildFilter from the request. The
separate 'stale AuthKey_<id>.p8' finding is now documented in
AGENTS.md under 'App Store Connect key location'.
* sitiai (upload + signing-identity hardening): all six findings
landed. Pre-flight altool --validate-app, body-aware success,
.app-vs-.pkg distinction shipped in crates/frontend/src/upload.rs;
asc signing doctor (PR #25); asc apps await-processing (PR #26);
list_builds pagination doc (PR #24). The credential-blocked live
ASC smoke test is the one remaining item and is shared with the
klepon plan.
* splitfire (TestFlight release session): testflight CLI surface
shipped; the 'rebuild asc first' warning and the
finish-the-release recipe are now in AGENTS.md under 'Verify
before relying on a freshly built asc' and 'Finish-the-release
recipe (TestFlight)'.
AGENTS.md (symlinked from the repo root as both AGENTS.md and
CLAUDE.md) gains three short sections instead of one big paragraph,
so a reader scanning the doc index can find each rule directly.
Verified locally: cargo fmt --check, cargo clippy -D warnings,
cargo test, RUSTDOCFLAGS=-D warnings cargo doc --workspace, and the
lower-crate solo builds (core / aso / signing) all clean.
Co-Authored-By: OndeCode v1.0.3-acp <noreply@ondeinference.com>
![sigit-code-review[bot]](https://avatars.githubusercontent.com/in/3492899?s=60&v=4){kind=small}
There was a problem hiding this comment.
This change closes out the three release-session plan files in .agents/plans/, marking all actionable findings as shipped and folding the remaining useful process notes into AGENTS.md. The new sections in AGENTS.md document key operational lessons: the need to rebuild asc after CLI changes, the cross-repo App Store Connect key path drift, and a step-by-step TestFlight release recipe. Each plan file is updated to reflect its closed status, with explicit notes on which findings were shipped, which are now documented, and which remain blocked (the live ASC smoke test). No code changes are present; all modifications are to documentation and planning files. The summary and findings in each plan are now up to date, and all actionable items are either merged or documented for future sessions. No open findings remain from these plans except the credential-blocked smoke test, which is now clearly marked as such and not actionable from this repo. The documentation is now more discoverable and unified for future contributors.
Automated review by siGit Code Review · commit 0433fe0 · see the review dashboard
Co-Authored-By: OndeCode v1.0.3-acp <noreply@ondeinference.com>
a05f282 to
0433fe0
Compare
1 participant
Close out the three release-session plan files in
.agents/plans/. Every shipped code finding from them is already ondevelopment; the few still-useful notes are folded intoAGENTS.md(which is symlinked at the root as bothAGENTS.mdandCLAUDE.md) so future sessions don't have to dig through three plan files.Plan-by-plan
klepon (token-source + builds API) — all scope items landed.
token.rsis covered:CountingSourcemint-counting tests incrates/core/src/client.rs::tests,StaticToken/ boxed-source tests incrates/core/src/token.rs::tests. MCPlist_buildsalready constructsBuildFilterfrom the request (crates/mcp/src/lib.rs:201). The separate 'staleAuthKey_<id>.p8' finding is now documented inAGENTS.mdunder App Store Connect key location.sitiai (upload + signing-identity hardening) — all six findings landed. Pre-flight
altool --validate-app, body-awaresuccess, and the.app-vs-.pkgdistinction shipped together incrates/frontend/src/upload.rs.asc signing doctor(PR feat(signing): add macOS signing doctor #25),asc apps await-processing(PR feat(apps): add await-processing to poll builds to terminal state #26),list_buildspagination doc (PR docs(aso): clarify list_builds limit=200 is page size, not a cap #24). The credential-blocked live ASC smoke test is shared with the klepon plan and is the one remaining item.splitfire (TestFlight release session) — the testflight CLI surface shipped (PR feat(cli): add testflight build-localizations for "What to Test" #37). The 'rebuild
ascfirst' warning and the finish-the-release recipe are now inAGENTS.mdunder Verify before relying on a freshly builtascand Finish-the-release recipe (TestFlight).AGENTS.md additions
Three short sections instead of one big paragraph:
asc— the released binary can silently lagdevelopment(an upload still works because it shells out toaltool); rebuild before relying on a newly-added subcommand.~/.appstoreconnect/private_keyshere vs.~/private_keysin sibling repos) so the next 401 doesn't get re-investigated.ascapi apps uploadalready passes--p8-file-pathexplicitly, dodging half the drift..pkgto a TestFlight group: upload → poll to VALID → beta-review contact details → submit.Verified locally
cargo fmt --all -- --check,cargo clippy --workspace --all-targets --locked -- -D warnings,cargo test --workspace --locked,RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --workspace --locked, and the lower-crate solo builds (core / aso / signing) all clean.Not in scope
ASC_ISSUER_ID.onde-store/scripts/build-ios.sh,smbcloud-browser/scripts/build-ios.sh) live in sibling repos, so the fix is to setASC_PRIVATE_KEY_PATHexplicitly in the environment.AGENTS.mddocuments this.