v2.3.0

Added

• Codex CLI support. This repo's Skills are now loadable from OpenAI's Codex CLI, not just Claude Code — with zero changes to any Knowledge Contract, Skill, Reference, or Workflow. Design in rfcs/0002-codex-support.md.
  • .codex-plugin/plugin.json — Codex plugin manifest, skills field points at the existing skills/ directory as a whole. No per-domain translation file: Codex reads the same SKILL.mds Claude Code does. Corrects a stale assumption in docs/specifications/skill-spec.md (and, discovered mid-implementation, an identical stale claim in CLAUDE.md) that a per-domain skills/<domain>/agents/openai.yaml would eventually be needed.
  • .codex/INSTALL.md — two install paths: Codex's own plugin marketplace command, and a manual clone-and-symlink fallback (with Windows PowerShell equivalents for every step, including verify and uninstall).
  • npx/bin/install.js — when the claude CLI is absent but codex is present, prints Codex install instructions (pointing at the install doc's absolute GitHub URL, since an npx user hasn't cloned the repo) and exits 0, instead of erroring. Never spawns codex itself — its plugin install is interactive, run inside a Codex session, not scriptable.
  • README.md/npx/README.md — Installation section now mentions Codex support and links to the install doc.
  • .codex-plugin/plugin.json joins the release-version consistency check CLAUDE.md defines (five files → six); a pre-existing "four-file" miscount in the same paragraph (it said "four" while already listing five) is corrected to "six" alongside it.

v2.2.0

Added

• Level 4 Review #3 — L4.5 (does the cited Apple page actually say the quoted rule) closed for all 17 of Tier 2's domains and all 78 Contracts, 14 real defects found and fixed. Reviews #1/#2 explicitly left L4.5 open — a repository-only reading review cannot check live citation content. This one fetches it, via a JSON-endpoint workaround for developer.apple.com/documentation/*'s client-rendered pages, and closes the last four domains (eventkit's final citation, testing, security, backgroundtasks, and app-intents's remaining three Contracts) that a first pass had left open.
  • Two fabricated-but-plausible quotes each in usernotifications/notification-delegate-handling (delegate-timing and actionIdentifier rules) and core-data/managed-object-context-crud (perform/performAndWait and parent-context save rules) — the underlying rule was correct in all four cases, but the quoted sentence did not exist on the cited page. All four replaced with the real text.
  • storekit/transaction-updates-and-restoring-purchases Rule 3 — a misquote reversing Apple's actual claim. Completed a real, truncated quote with fabricated text asserting same-device purchases do replay through Transaction.updates; Apple's page says the opposite — they arrive through Product.PurchaseResult.success(_:) instead, and never through the listener. Fixed.
  • Two wrong rule-number citations in authenticationservices/session-persistence-and-sign-out, neither caught by prior reviews' mechanical id-resolution check (which verifies citation ids, not citation numbers against the target's actual rule count). Fixed.
  • passkit/adding-passes-ui Rule 5 — the review's largest finding, a false scope claim rather than a citation slip. The rule asserted PassKit ships no SwiftUI equivalent for adding a pass to Wallet, requiring UIKit wrapped in a representable. False since iOS 16: AddPassToWalletButton is a SwiftUI-native control that replaces the entire present/delegate/dismiss flow, not just the button. This silently invalidated the exact coupling review #1's T2-01 had verified under the premise (true when written) that no such control existed. Rewrote the rule, ## Intent, ## Scope, and the Compliant Example; corrected the same stale claim in domain-map.md's PassKit entry and in skills/passkit/SKILL.md's description/triggers/routing.
  • tipkit/tip-options-and-app-configuration Rule 2 substituted NSUbiquitousKeyValueStore (iCloud-synced) for UserDefaults (local) in the tvOS default-datastore quote — a materially different persistence mechanism, not a wording nit. Fixed.
  • One misattributed quote in passkit/adding-passes-ui Rule 4 (PKPaymentButton's text attributed to PKAddPassButton) and one minor stale-citation note in passkit/apple-pay-authorization-and-result-handling Rule 4 — both fixed.
  • A link-freshness defect found as a side effect, not L4.5 itself: privacy/tracking-domains-and-third-party-sdk-signatures cited a URL serving a soft 404 (Apple's real "page not found" template at HTTP 200) — a class check_links.py cannot catch by status code alone. Corrected to the live URL (case/trailing-slash differed).
  • Two fork-reported findings were re-verified and ruled out before any edit — a passkit/apple-pay-payment-request citation and an app-intents CaseDisplayRepresentable citation both checked out as correct on independent direct re-fetch, contradicting the initial report.
  • A currency finding in backgroundtasks: submit(_:) is now deprecated (iOS/iPadOS/tvOS 27.0, visionOS 1.0) in favor of the still-Beta submitTaskRequest(_:completionHandler:) — noted in background-task-registration-and-scheduling rather than rewritten around an unstable replacement.
  • Four more fabricated-quote fixes across testing and app-intents: xctest-case-structure-and-assertions, swift-testing-fundamentals (2 paraphrase tightenings), expectations-for-asynchronous-code, app-entities-and-queries (2 fixes, one a quote-order correction, one sourced from a reorganized App Intents doc page not previously cited), and intent-results-and-widget-hookup (OpensIntent's abstract misattributed from its sibling types' pattern).
  • security came back fully clean — 4/4 Contracts, the only domain checked this review with zero findings of any kind.
  • A genuine tooling limit named rather than guessed around: two HIG-page citations in app-shortcuts-and-siri-phrases are left explicitly unverified — Human Interface Guidelines pages have no working JSON-endpoint equivalent, confirmed by testing the pattern directly.
  • Coverage: all 17 Tier 2 domains now have every citable quote checked at least once, with two exceptions named rather than silently passed — the two HIG quotes above, and reference-only citations across localization/foundation/privacy/authenticationservices/storekit with no attached quotation to verify.
• Level 4 Review #2 — Tier 2's L4.1/L4.4 checks run unsampled for the first time, plus Skill routing content. Review #1 (2026-08-08) covered L4.2/L4.3 completely by construction but sampled L4.1 and checked L4.4 only mechanically (citation ids resolve, not that the citing sentence is still true). This review reads all 78 Tier 2 Knowledge Contracts in full against both checks, then extends L4.4 to the 17 Tier 2 Skills' ## Routing tables — a Skill-to-Knowledge dependency neither prior review had verified as content-true, only structurally resolvable.
  • L4.1 — 0 findings, all 78 Contracts. Confirms on the full population, not a sample, #1's conclusion that the atomicity heuristic over-flags and Tier 2's Contracts are genuinely atomic.
  • L4.4, Knowledge side — 1 finding, fixed. localization/layout-direction-and-rtl-apis's related edge for "general SF Symbols usage" pointed at sf-symbols/symbol-variants, a Contract scoped only to the .fill/.circle/.square/.slash mechanic — not general usage. The Contract's own ### Excluded list already stated the boundary correctly and generically; only the machine-checked edge narrowed it to the wrong target. Repointed to sf-symbols/symbol-basics, the Contract every other sf-symbols Contract depends on. This is the L4.4 failure mode the checklist names but had not yet produced an instance of: Level 2 proves an id resolves, not that it's the right id.
  • L4.4, Skill-routing side — 0 findings, 17/17 Skills, ~78 routing bullets, ~55 Stop-Condition hand-offs. Every routing bullet still matches its target Contract's current scope; every hand-off still names the domain that actually owns the deferred rule.
  • L4.5 (does the cited Apple page actually say the quoted rule) is named as still open rather than silently skipped — it needs fetching live citation content, a different-shaped task from a reading review.
• Vertical slice #7 — the Tier 3 pilot's own test, and the one boundary its method could not see. The pilot built core-location and photos against nine boundaries classified in domain-map.md before either domain existed, testing slice #6's rule: a boundary decided in advance does not need a slice to find its gaps; one that emerges from two independently-correct domains does. Until now the pilot's verdict came from the build, not from a task. This slice supplies the task — a photo-journal "Places" feature that picks photos, shows where each was taken, and reacts on returning to a place while the app is not running.
  • The rule holds. Four pre-classified boundaries were exercised and none produced a seam defect. The uikit-interaction correction from the previous phase is load-bearing rather than documentary: a SwiftUI task reaches picker-and-selection-results Rule 2 (use PhotosPicker, do not wrap) and never the opposed limited-library Rule 5, so two rules that contradict each other on purpose produced no ambiguity. The backgroundtasks coupling forecloses the BGAppRefreshTask polling loop under the exact phrasing that invites it. Both domains delegate usage-string wording to app-store-review-guidelines in identical shape, which is the duplicated rule the pre-classification was written to prevent.
  • The finding is at the tenth boundary, which nobody classified. PHAsset.location is declared var location: CLLocation? { get } — Photos hands back a Core Location type under the photo-library grant, with no location authorization involved. Neither domain said so. An agent either stops and reports (the task cannot be completed) or requests requestWhenInUseAuthorization() for data already in hand, prompting the user for something the feature never uses. Fixed here: knowledge.photos.asset-fetching Rule 5 owns it, knowledge.core-location.authorization-and-usage-strings excludes it by name, both Skills carry the split in their Stop Conditions, and the Routing Index gains the keywords so the boundary is resolvable where routing happens.
  • The method has a blind spot exactly the size of a multi-domain phase. The classification pass enumerated each new domain against domains that already existed, so a seam between two domains built in the same phase was never a candidate. domain-map.md's Rules now require new domains to be classified against each other, and review-checklist.md L4.3 gains the question that would have found it — does this domain hand back a type another domain owns? Both prior unowned-coupling defects were two Contracts each deferring half a decision; this one is two Contracts saying nothing at all, which L4.3's existing question cannot reach.
  • The photos Reference now indexes 42 Apple URLs (the previous entry's count of 42 was one early — it indexed 41).
• Tier 3 pilot, second half — the photos domain, and the boundary the pilot got wrong in a new way. 6 Knowledge Contracts, 1 Reference indexing 42 Apple URLs, 1 Skill, 1 Routing Index row...

v2.0.0

Major version bump marking a repo structure/documentation milestone — 16 of 18 Tier 2 domains complete, no new domain content in this release.

Changed

• README.md's ## Skills section condensed from 31 multi-line entries to one bullet per Skill (name, one-line description, link to that Skill's own SKILL.md).
• README.md's ## What's New capped at its 3 most recent entries going forward; full history stays in CHANGELOG.md. Both rules codified in CLAUDE.md.
• npx/README.md re-synced as a byte-identical mirror of README.md.

Full history: CHANGELOG.md

v1.0.3

Both named Tier 1 priority gaps closed: human-interface-guidelines Patterns/Components/Inputs (18 Knowledge Contracts, #26) and swiftui Animation/Gestures (10 Knowledge Contracts, #27). Each is now the project's second/third domain with more than one Skill — routing split to stay under the Reference (≤80 lines) and Skill (≤60 lines) size caps.

See CHANGELOG.md for full history and docs/architecture/domain-map.md for per-domain scope and cross-domain boundary notes.

v1.0.2

All 11 Tier 1 domains complete: style-guide, human-interface-guidelines, app-store-review-guidelines, swiftui, accessibility, uikit, sf-symbols, networking, xcode, local-authentication, app-tracking-transparency, plus authentication (cross-cutting).

See CHANGELOG.md for full history and docs/architecture/domain-map.md for per-domain scope and cross-domain boundary notes.

Preceded by a full-repo final review pass (see #25) fixing cross-domain consistency issues found across all domains.

v0.1.2

What's Changed

• style-guide domain (RFC 0001) + Claude Code plugin packaging by @caglarbaranbora in #1
• OSS hygiene: LICENSE, CONTRIBUTING, CLAUDE.md, README + npm listing by @caglarbaranbora in #2
• chore: pre-marketplace hardening by @caglarbaranbora in #3
• Native skill foundation hardening: authentication + style-guide as real Claude Code skills by @caglarbaranbora in #4
• Add human-interface-guidelines domain (Foundations, iOS/iPadOS) by @caglarbaranbora in #5
• docs: add Skills + What's New sections to README by @caglarbaranbora in #6
• feat: add App Store Review Guidelines domain by @caglarbaranbora in #7
• Add swiftui domain (Views/Navigation/Layout/State, iOS17+) by @caglarbaranbora in #8
• Add accessibility domain (SwiftUI + UIKit Accessibility API v1) by @caglarbaranbora in #9
• Add uikit domain (programmatic screen-scaffolding v1) by @caglarbaranbora in #10
• Add sf-symbols domain (core rendering/variants v1, SwiftUI + UIKit) by @caglarbaranbora in #11
• Add networking domain (async/await URLSession v1) by @caglarbaranbora in #12

Full Changelog: https://github.com/caglarbaranbora/Apple-Agent-Kit/commits/v0.1.2