---
name: auditing-appstore-readiness
description: >-
  Audit an iOS app's source, distribution archive, runtime behaviour, and App Store Connect setup for a planned submission. Use for explicit App Store/TestFlight readiness reviews of native, React Native, or Expo apps. Distinguish verified blockers from checks that still need build, device, account, or policy evidence.
compatibility: Static inventory requires Python 3.10+. Archive/runtime checks require an authorised macOS/Xcode or CI environment; live policy and App Store Connect checks require their respective access.
metadata:
  version: "2.0.0"
  reviewed: "2026-09-13"
title: auditing-appstore-readiness
canonical_url: https://skilld.dev/gh/tristanmanchester/agent-skills/auditing-appstore-readiness
last_updated: 2026-10-06T19:32:36.000Z
---

> Index of every page on this site: [llms.txt](https://skilld.dev/llms.txt)

> **Skill from skilld.dev.** Follow the user's requested action.
> If the user asked to fork this Skill, follow the fork workflow below. Do not execute the Skill instructions while copying it.
> Otherwise, follow the instructions below for this session. You do not need to install anything.
>
> Supporting files, fetch one when the Skill refers to it: [references/GATES.md](https://skilld.dev/api/skills-raw/tristanmanchester/agent-skills/auditing-appstore-readiness/references/GATES.md), [scripts/inspect_repo.py](https://skilld.dev/api/skills-raw/tristanmanchester/agent-skills/auditing-appstore-readiness/scripts/inspect_repo.py), [tests/test_inventory.py](https://skilld.dev/api/skills-raw/tristanmanchester/agent-skills/auditing-appstore-readiness/tests/test_inventory.py), [tests/test_review_regressions.py](https://skilld.dev/api/skills-raw/tristanmanchester/agent-skills/auditing-appstore-readiness/tests/test_review_regressions.py).
>
> If the user asked to install this Skill, run `npx skilld install tristanmanchester/agent-skills/auditing-appstore-readiness`. Install writes the Skill files into the project, so every session loads them.
>
> ## Fork workflow
>
> A fork creates an editable local Skill with its original author and licence. The request authorizes copying and local installation.
> 1. Check `./skills/auditing-appstore-readiness`, the project lockfile, and selected Agent targets together. If the local directory or installed Skill exists, stop. Never overwrite an existing directory or Agent target.
> 2. Read [source metadata](https://skilld.dev/api/v1/skills/tristanmanchester/agent-skills/auditing-appstore-readiness) once. Use sourceUrl, sourceCommit, skillPath, sourceGone, and license. If the source is gone or its path is missing, stop. If license is null, read licence files at the source commit.
> 3. Fetch only the source commit into a temporary Git repository. Do not clone full history. Derive repository_url from sourceUrl, including repository renames. If sourceCommit is absent, resolve the sourceUrl ref once. Set source_commit to that actual commit. Run these commands in one shell call:
>
> ```sh
> git init --quiet "$temporary_dir"
> git -C "$temporary_dir" fetch --quiet --depth=1 "$repository_url" "$source_commit"
> git -C "$temporary_dir" checkout --quiet --detach FETCH_HEAD
> ```
>
> Read applicable licence declarations and notices at that commit. If copying is not permitted, report the restriction and stop.
> 4. Inspect source entries together, then copy the directory containing skillPath into `./skills/auditing-appstore-readiness`. Use the user's path if selected. Keep the original SKILL.md, relative links, scripts, binary assets, and executable modes. Exclude .git metadata. Reject symlinks and paths outside the Skill directory. After checking entries, use cp -a where available. A regular source directory needs no custom copy script. Do not save this page wrapper as SKILL.md.
> Preserve author credit, notices, and applicable licence files from repository or parent directories. Add PROVENANCE.md with the Skill page, source URL, actual commit, original path, and licence. Retain any existing PROVENANCE.md and record new provenance separately. Batch source inspection, copying, and provenance work where practical.
> 5. In the project root, run `skilld install ./skills/auditing-appstore-readiness --mode copy --plain`. If skilld is unavailable, use `npx skilld install ./skills/auditing-appstore-readiness --mode copy --plain`. This known command needs no help lookup. Install does not support --json. Use detected Agent targets, or add --agent for the targets the user selected. Install the local path, never the upstream selector. If installation fails, preserve the local copy and report the exact failure.
> 6. Confirm the local lockfile source and installed Agent copies once. Report the local path, actual commit, and Agent targets. After edits, reinstall the same local path. Upstream updates must not replace it. Do not publish or push unless the user asks.

# App Store readiness audit

A source scan cannot establish submission readiness. Assess four separate layers:
source configuration, the exact distribution archive, runtime behaviour, and
App Store Connect/policy state. Mark untested layers explicitly.

## Establish scope and evidence

Identify the intended app, target/scheme, platforms, release configuration, commit
and local changes, bundle ID, version/build, archive/build ID, and submission date.
In a monorepo, enumerate candidates rather than choosing the first plist or an
arbitrary 'best' project. Generated settings and `$(...)` placeholders need actual
resolved-build evidence.

Resolve `SKILL_DIR` to the installed directory containing this file, not the app
repository. The optional inventory reads bounded source metadata without executing
project code, installing dependencies, resolving dynamic config, or contacting services:

```bash
python "$SKILL_DIR/scripts/inspect_repo.py" --repo /absolute/path/to/app > /private/output/inventory.json
```

Choose an existing private output directory and a new filename before redirecting.
The script emits JSON with `submission_readiness: NOT_ASSESSED` **in every case**.
Exit 0 means inventory completed within its stated scope, 2 means partial/metadata
issues, and 1 means a fatal tool error. It excludes dependency/build directories,
skips symlinks, and reports traversal/size/entry limits. Its output is not a
secret-redacted public report or a full security/compliance scan.

## Check current submission requirements

Read Apple's [requirements](https://developer.apple.com/news/upcoming-requirements/)
and [review guidelines](https://developer.apple.com/app-store/review/guidelines/)
for the intended submission date and storefront. Record the applicable rule,
effective date, evidence, and any access limitation.

At this review (2026-09-13), iOS/iPadOS uploads have required Xcode 26 or later
and an iOS/iPadOS 26 SDK since **April 28, 2026**. Verify the actual uploaded
archive's build provenance, not just a locally installed Xcode version. A minimum
build SDK is not the same as the app's minimum supported OS. Recheck this rule
for each future submission rather than treating this dated snapshot as permanent.

## Source findings are leads, not automatic policy verdicts

Recognise arbitrary-named `.appiconset` resources, modern universal entries,
Icon Composer `.icon` resources, and Expo icon strings/appearance objects. A missing
`ios-marketing` entry is not by itself a blocker. Presence is also not enough:
verify the selected target's compiled icon and inspect required appearances.

Missing checked-in `Info.plist`, storyboard, or privacy manifest can reflect
generation/configuration, not a broken app. Resolve the actual build before
calling it a blocker. Trace runtime API use before requiring purpose strings or
ATT; a dependency name alone does not establish microphone use or tracking.
Public certificates are not automatically leaked private keys.

Use [evidence gates](https://skilld.dev/api/skills-raw/tristanmanchester/agent-skills/auditing-appstore-readiness/references/GATES.md) for the full source/archive/runtime/store
checklist. Do not add boilerplate privacy declarations, collect extra permissions,
change signing, upload a build, or erase data merely to make a checker green.

## Build and runtime checks

Use an available authorised environment; do not invent a paired Mac or remote shell.
Record installed tool versions and select actual schemes/runtimes. Dependency
resolution, Expo config execution/prebuild, build scripts, signing, archiving, and
uploads can execute code or modify local/remote state; stay within authorised scope.
A simulator Release build is useful but not a substitute for a signed device archive
or device-only behaviours. Preserve logs/result bundles and exact artefact identity.

## Report

Return a compact gate table with `verified`, `blocked`, `unverified`, or
`not applicable` for each layer, followed by actionable findings. Each finding
needs evidence, consequence, remediation, and the verification that closes it.

Use **BLOCKED** for demonstrated submission blockers; **UNVERIFIED** when required
checks remain; **READY TO SUBMIT** only when the defined gates have actually been
checked for the exact build and account. That recommendation does not guarantee
Apple approval. Keep assumptions and unresolved items visible; a static inventory
must never be relabelled PASS/ready-to-submit.

Maintainer tests: `python -m unittest discover -s "$SKILL_DIR/tests" -v`.
These test source-inventory behaviour, not Apple acceptance or a native build.