apple build: --derived-data (default <out>/DerivedData with --out), --path-free (Swift/clang prefix maps, no serialized debug options) and an archive path scan

skills/build-and-sign/SKILL.md

@@ -64,6 +64,11 @@ when the owner said so for this run). The MCP server offers only `apple_signing_
    unlocks that one; `signing ensure --keychain <path>` imports the key + certificate into it). It
    also stops before the archive when a target's App Group is missing (manual: its installed profile; automatic: the profile
    the API lists; store-pitfalls 121; `--allow-app-group-gap` overrides).
+   `--out <dir>` also puts DerivedData in `<out>/DerivedData` (`--derived-data <dir>` / `apple.build.derivedData`
+   overrides), so a build is hermetic per output folder. Building under a shared folder, or anything a privacy gate scans:
+   add `--path-free` (`apple.build.pathFree`): Swift and clang prefix maps keep the home folder, user name and checkout
+   out of the binary and the archive's dSYMs / Symbols, and the build stops before the export on a leftover hit
+   (store-pitfalls 124). `--scan-paths` scans without remapping.
    - Capacitor: the archive ships the web assets `npx cap sync` copied last. Set `build.prebuild` (e.g.
      `"npm run build && npx cap sync"`; per store `apple.prebuild` / `play.prebuild`) and `apple build` / `play build`
      run it first (once per `flow run`; `--no-prebuild` skips it). Then the copied `public/index.html` must be newer

skills/store-pitfalls/SKILL.md

@@ -1533,3 +1533,17 @@ that fails without the fix (see CONTRIBUTING.md).
   update-or-first from the config instead of the store.
 - **Guard:** `cli/lib/release-kind.ts` (the kind from the store, the policy), `tests/update-gate.test.ts` (fake stores:
   update goes through, first release is exit 3, already there is exit 7), docs/bypass.md "Updates are agent steps".
+
+## 124. iOS builds leak the home folder: DerivedData in ~/Library and local paths in the binary and the symbols
+
+- **Symptom:** a release pipeline building under a shared folder outside the user's home (`apple build --out <dir>`)
+  still wrote DerivedData to `~/Library/Developer/Xcode/DerivedData`, and the app binary and the `.xcarchive`
+  `Symbols/*.symbols` / dSYMs held the home folder, the user name and the checkout path (a privacy gate counted 543 hits).
+- **Do:** `storebound apple build --out <dir> --path-free` (or `apple.build.pathFree: true`). With `--out` DerivedData is
+  `<out>/DerivedData` (`--derived-data <dir>` / `apple.build.derivedData` to choose); `--path-free` passes Swift
+  `-debug-prefix-map` + `-file-prefix-map` and clang `-ffile-prefix-map` for the home folder, checkout, out and DerivedData,
+  keeps dwarf-with-dsym (symbol upload still works) and scans the archive's Products, dSYMs and Symbols before the export.
+  A hit stops the build with the count and the first file + offsets. Xcode's own toolchain paths (`/Applications/Xcode.app`)
+  are not the user's and are not hits. A prebuilt vendored framework carries its own paths: rebuild it path-free.
+- **Never:** point a shared build folder at the default DerivedData, or run the privacy scan only after the upload.
+- **Guard:** `cli/lib/path-free.ts`, `tests/path-free.test.ts`, the hint when `--out` is outside the home folder.