apple signing: App Group association fails early under automatic signing too (API capability + newest profile, steps and deep link, exit before the archive); console plan/verify apple-app-group

skills/store-pitfalls/SKILL.md

@@ -1465,7 +1465,6 @@ that fails without the fix (see CONTRIBUTING.md).
   attributes first, `text=` last); `shots capture --dry` prints them per size, `--dry --probe` opens the pages and
   names the MISS with the size and every candidate's match count.
 - **Guard:** `tests/shots-gaps.test.ts`, `tests/browser/feature-fit.browser.ts` (rotate), `cli/shots/selectors.ts`.
-||||||| parent of ae8d773 (apple signing: every signable target (extensions, App Group check), build keychain unlock over SSH, api confirm docs)
 
 ## 121. An app extension (share extension, widget, watch app) could not be signed: bundle id not registered, capabilities missing, App Group not in the profile
 
@@ -1481,14 +1480,21 @@ that fails without the fix (see CONTRIBUTING.md).
   and CODE_SIGN_ENTITLEMENTS of the Release configuration) and what it would register, enable and create; without
   `--dry` it registers the extension bundle ids, enables the capabilities its entitlements need (the entitlement-to-
   capability table; `keychain-access-groups` needs none) and, for manual signing, creates an App Store profile per
-  target. It then decodes each profile and compares its App Groups with the target's entitlements: a gap fails with
+  target. It then compares each target's App Groups with what the API shows (manual signing: the decoded profile; automatic
+  signing: the App ID's APP_GROUPS capability settings and the newest profile the API lists for the bundle id, an
+  Xcode-managed one too; a profile that carries no group, or the capability off, is a gap; nothing readable is
+  "cannot be proven" and only warns with the same steps): a gap fails with
   the developer portal deep link `https://developer.apple.com/account/resources/identifiers/bundleId/edit/<id>` and the
   steps to tick the group (drive it in the signed-in browser; never press Remove / Delete / Revoke). After that
   `storebound apple signing ensure --refresh-profile` makes the profile again (a normal run reuses the active one, so it
-  does not pile up profiles while the group is unassigned). `apple build` (manual signing) stops before the archive on the
-  same gap (`--allow-app-group-gap` overrides). A variable bundle id (set in an xcconfig) is not resolvable: list the
+  does not pile up profiles while the group is unassigned). `apple build` stops before the archive on the same gap in both
+  signing styles (manual: the installed profile; automatic: read through the API; `--allow-app-group-gap` overrides, e.g.
+  when the group was just ticked and Xcode will renew its managed profile at archive time). The agent-first plan is
+  `storebound console plan apple-app-group --bundle-id <id>` (`--lookup` adds the deep link; its Save is the agent's own, not a
+  store submission) and `storebound console verify apple-app-group` re-reads the App ID and the newest profile (after the
+  portal Save the old profiles are invalid: run `signing ensure --refresh-profile` first). A variable bundle id (set in an xcconfig) is not resolvable: list the
   extension in `apple.signing.extensions` (`bundleId`, `capabilities`, `appGroups`), which replaces the detected ones.
 - **Guard:** `cli/lib/targets.ts` (pbxproj targets, App Group comparison, portal link and steps), `discoverTargets` in
   `cli/apple/signing.ts`, `tests/signing-targets.test.ts` (fixture pbxproj with an app, a share extension and app group
-  entitlements, a decoded profile plist, a fake App Store Connect). There is no `console plan` form for the portal page:
-  the steps are in the error and the warning.
+  entitlements, a decoded profile plist, a fake App Store Connect), `cli/lib/console-apple-group-plan.ts` (the plan),
+  `verifyAppGroupsApi` in `cli/lib/console-verify.ts`, `appGroupVerdicts` in `cli/lib/targets.ts` (gap / unproven / ok).