Pricing folded into the authorization moment (v1.64.19.0)

CHANGELOG.md

@@ -7,6 +7,18 @@
 > completion state and remaining P0 gates. No version bump or release claim is
 > made here while that status holds.
 
+## [1.64.19.0] - 2026-07-24
+
+**Free or paid is your call, asked once, inside the question you already answer.**
+
+Price is a launch decision: a free launch cannot be un-launched, and a paid app sells nothing until the banking agreement is signed. The release no longer defaults it silently — the one authorization question now also settles free-or-paid (and the price), once per app ever, remembered in the decision store so repeat releases stay zero-question. Paid answers get told about the one-time banking/tax agreement up front instead of at the finish line. Pricing also executes reliably now: it runs through Apple's price-schedule API directly, because fastlane's own pricing option is broken against the current App Store Connect API (proven on a live release).
+
+### Itemized changes
+
+### Changed
+
+- `skills/ship/references/APPLE-RELEASE.md`: pricing folded into the authorization moment (once per app, decision-store persisted, paid → Paid Apps agreement named up front); storefront pricing pinned to `POST /v1/appPriceSchedules` with fastlane `price_tier` documented as broken against the current API.
+
 ## [1.64.18.0] - 2026-07-24
 
 **Your sign-in now mints the upload credential. Nobody types an app-specific password.**

VERSION

@@ -1 +1 @@
-1.64.18.0
+1.64.19.0

package.json

@@ -1,6 +1,6 @@
 {
   "name": "gstack",
-  "version": "1.64.18.0",
+  "version": "1.64.19.0",
   "description": "GStack 2 \u2014 six portable Agent Skills with an optional host-neutral runtime.",
   "license": "MIT",
   "type": "module",

scripts/gstack2/generate-skill-tree.ts

@@ -645,7 +645,7 @@ One tool runs the entire release: machine-level fastlane — \`produce\` (app re
 
 ## The one authorization moment
 
-The whole journey permits exactly two interactions, and no others. FIRST, up front: confirm the user holds a paid Apple Developer Program membership (US$99/year — the App Store and TestFlight both require it) and authorize the release. Apple sign-in happens inside this same moment: run \`fastlane spaceauth -u <apple-id>\` through the host's interactive command path (in Claude Code, the user types \`! fastlane spaceauth -u <email>\` so their password and one two-factor code go directly to Apple in-session; a separate terminal window is the fallback only when the host has no interactive path). Keep the printed session token out of the transcript — the cached cookie in \`~/.fastlane/spaceship/\` is the credential fastlane actually uses; never store, echo, or log the password or token, and re-run the same one command when the session expires. Immediately after the first sign-in, mint the permanent upload key from the session (step 4 of Archive and upload) — when that key already sits at \`~/.gstack/apple/api-key.json\` and no new app record is needed, skip the sign-in entirely: repeat releases authorize and proceed with zero sign-in. SECOND, only when preflight finds the icon or screenshots missing: the store-assets question below. Everything else — tool installs, upload, storefront, submission — is covered by the authorization and proceeds without asking. Auth menus, tool-choice questions, plan confirmations, and step-by-step narration requests are contract violations.
+The whole journey permits exactly two interactions, and no others. FIRST, up front: confirm the user holds a paid Apple Developer Program membership (US$99/year — the App Store and TestFlight both require it) and authorize the release. Pricing belongs to this same breath, once per app EVER: ask free or paid (and the price if paid) inside the authorization question — never as a separate interruption — after checking the decision store (\`bin/gstack-decision-search --scope repo --query "pricing"\`); persist the answer (\`bin/gstack-decision-log\`, scope \`repo\`) so no later release re-asks, and a paid answer names the one-time Paid Apps banking/tax agreement honestly right there, since nothing sells until it is signed. Price is a launch decision the agent never defaults silently: a free launch cannot be un-launched. Apple sign-in happens inside this same moment: run \`fastlane spaceauth -u <apple-id>\` through the host's interactive command path (in Claude Code, the user types \`! fastlane spaceauth -u <email>\` so their password and one two-factor code go directly to Apple in-session; a separate terminal window is the fallback only when the host has no interactive path). Keep the printed session token out of the transcript — the cached cookie in \`~/.fastlane/spaceship/\` is the credential fastlane actually uses; never store, echo, or log the password or token, and re-run the same one command when the session expires. Immediately after the first sign-in, mint the permanent upload key from the session (step 4 of Archive and upload) — when that key already sits at \`~/.gstack/apple/api-key.json\` and no new app record is needed, skip the sign-in entirely: repeat releases authorize and proceed with zero sign-in. SECOND, only when preflight finds the icon or screenshots missing: the store-assets question below. Everything else — tool installs, upload, storefront, submission — is covered by the authorization and proceeds without asking. Auth menus, tool-choice questions, plan confirmations, and step-by-step narration requests are contract violations.
 
 No membership: STOP the App Store path. Offer to walk enrollment at developer.apple.com through \`references/THIRD-PARTY-ACTIONS.md\` (a purchase the user completes themselves; activation can take a day or two), and name the free-account ceiling honestly: personal-team installs on the user's own devices only, expiring after 7 days, no TestFlight, no App Store.
 
@@ -681,7 +681,7 @@ Build this question's options from a LIVE check of installed skills at ask time
 
 ## Storefront completion
 
-\`produce\` already created the app record and bundle ID during the run — never call the app record a manual gate. \`deliver\` owns everything the store listing needs: description, keywords, localizations, screenshot upload per device size, attaching the uploaded build, and Submit for Review; \`pilot\` manages TestFlight groups and testers as an intermediate round when the user asked for one. Submission is an external effect like the upload: durable key \`appstore.submit.<bundle-id>.<version>\`. Monitor review status from the CLI afterward.
+\`produce\` already created the app record and bundle ID during the run — never call the app record a manual gate. Apply the pricing settled in the authorization moment through the App Store Connect price-schedule endpoint (\`POST /v1/appPriceSchedules\` via the session or the minted key): fastlane's \`price_tier\` option is broken against the current API ("'prices' is not a relationship on 'apps'"), so never route pricing through it or call its failure an account problem. \`deliver\` owns everything else the store listing needs: description, keywords, localizations, screenshot upload per device size, attaching the uploaded build, and Submit for Review; \`pilot\` manages TestFlight groups and testers as an intermediate round when the user asked for one. Submission is an external effect like the upload: durable key \`appstore.submit.<bundle-id>.<version>\`. Monitor review status from the CLI afterward.
 
 What remains web-only, ever: the paid Apple Developer Program membership purchase itself (a precondition, not a release step) and, for PAID apps only, the one-time Paid Apps agreement with banking and tax — offer the agentic-browser drive per \`references/THIRD-PARTY-ACTIONS.md\` before any manual checklist for those. A free app needs no browser at any point. After submission, report that App Review typically answers within a day or two and close the run; review outcome is not a gate this workflow can hold open.
 `;