30 lines
2.7 KiB
Markdown
30 lines
2.7 KiB
Markdown
# storebound · rules for AI agents
|
|
|
|
These rules apply to every AI tool that uses storebound (skills, MCP server or the CLI in a terminal).
|
|
|
|
**Read `skills/store-pitfalls/SKILL.md` before any store task.** It lists the mistakes already made in real releases
|
|
(store lists that lag after a create, dry runs without a plan, taken App Store names, byte limits, ...) and what to do.
|
|
|
|
1. **The owner decides public and irreversible steps.** Submitting for review (App Review or Beta App Review),
|
|
releasing a version, resuming or completing a rollout, canceling a submission, deleting products or listings,
|
|
accepting agreements, sending review replies, inviting or removing testers, changing prices, starting or stopping
|
|
a store experiment: explain what will happen and let the owner do it (or run the command only after a clear yes in
|
|
chat). storebound's MCP server does not offer these at all.
|
|
2. **Dry run first.** Every write command has `--dry` (MCP: `dry_run`, default true). Show the dry run (the rows that
|
|
change, not just a count), then run it for real only after the owner agrees.
|
|
3. **Read before you write.** `storebound scan` (offline: rejection risks in the project itself), `storebound check`
|
|
(offline) and `storebound validate` (read-only, both stores) tell you what is missing and in which order to fix it.
|
|
4. **Credentials only from the environment, `.storebound/`** in the project (gitignored) **or a credential profile**
|
|
(`~/.storebound/credentials/<profile>.json`, named by `--account <profile>` or a workspace). Never ask for keys,
|
|
passwords or tokens in chat, never print them, never write them into the config, docs or commits. The same goes
|
|
for the App Review demo account (`reviewDemoAccount` in `.storebound/credentials.json`): the owner puts it there.
|
|
5. **Never answer a compliance question you cannot know.** Export compliance, Data safety, App Privacy, age rating,
|
|
target audience: ask the owner when the code does not prove the answer. A wrong "no" is worse than a slow "ask".
|
|
6. **Pick builds by explicit number.** Use the build number / versionCode you just uploaded, never "the latest".
|
|
7. **Long uploads run in the background with a log** (`storebound play images > .storebound/images.log 2>&1 &`) and
|
|
you report the progress lines, not guesses.
|
|
8. **No manipulative tactics** with reviewers, players or store policies: no fake reviews, no incentives for ratings,
|
|
no hidden features, no misleading screenshots, no keyword stuffing.
|
|
9. **Personal data stays local.** Tester lists, review reply drafts, health reports and analytics snapshots live in
|
|
`.storebound/` (gitignored). Never put tester emails, reviewer names or crash logs into issues, docs or commits,
|
|
and never ask for tester emails in chat (storebound masks them in its output).
|