CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

agent rules: first rule "Do it, don't ask" (agents-core and every adapter, README, store-pitfalls lead, first-release, declarations and console skills); the agent runs the real command after the dry run, the owner presses only final public or irreversible buttons and answers compliance facts in one batch; handoff text removed from skills; tests/do-it-dont-ask.test.ts. Pitfall 26

Browse source
This commit is contained in:
CRTkafa 2026-10-12 09:28:45 +08:00
parent fc524cd2d4
commit dfc28c15f8
22 changed files with 393 additions and 105 deletions
Download patch file Download diff file Expand all files Collapse all files

13
skills/store-declarations/SKILL.md
View file

@ -5,6 +5,11 @@ description: Answer the store compliance forms for a mobile app or game - Google
# Store declarations
**Do it, don't ask** (first rule in AGENTS.md): you fill these forms yourself (API, or the console with your browser
tool from `storebound console plan`). Ask the owner only the answers no code or config proves, all in one batch at
the start, and save them in the config; the owner presses only App Privacy Publish and the final Submit / Save of a
console questionnaire.
`storebound scan` proposes the Data safety and App Privacy answers from the detected SDKs and code (each item "detected (file:line)" or "ask owner") as a diff against `dataSafety` / `appPrivacy`; `--write` adds only the detected ones after the owner agrees.
Templates: `store/declarations.md` (Play App content + IARC answers), `store/app-privacy.md` (Apple labels), both
@ -21,12 +26,14 @@ CLI: `storebound` (or `bunx storebound` in a project that has it, or `bun <toolc
Play cannot read the form back: storebound keeps the hash of the last upload in `.storebound/data-safety.sha256`
and skips an unchanged CSV. After a hand edit in Play Console, `--force` sends the config's answers again.
Then check the summary in Play Console > Policy and programs > App content > Data safety.
3. **Play App content (UI).** Policy and programs > App content, each card with `store/declarations.md`:
3. **Play App content (UI, you drive it).** Policy and programs > App content, each card with `store/declarations.md`
(`storebound console plan play-content-rating` / `play-target-audience` for the forms it knows):
privacy policy, app access, ads, content rating (IARC questionnaire), target audience and content, news, COVID-19,
data safety, government apps, financial features, health, advertising ID.
4. **Apple age rating (API).** `storebound apple appinfo` (all NONE except your overrides, e.g. `advertising: true`).
5. **Apple App Privacy (UI only).** App Store Connect > the app > App Privacy > Get Started / Edit, from
`store/app-privacy.md`; per data type: purposes > linked to identity > used for tracking. Then **Publish**.
5. **Apple App Privacy (UI only, you drive it: `storebound console plan apple-app-privacy`).** App Store Connect >
the app > App Privacy > Get Started / Edit, from `store/app-privacy.md`; per data type: purposes > linked to
identity > used for tracking, Save. Then the owner presses **Publish**.
- Purposes follow Apple's definitions (developer.apple.com/app-store/app-privacy-details/), one per Play purpose:
Play `advertising` (ads from an ad SDK) is **Third-Party Advertising only**, never also Developer's Advertising
or Marketing (that one is first-party ads or marketing to your own users: the owner's answer); `analytics` is