MANUAL RUN: the iOS block (Bob and Apple, all iOS owner-hands work in one day) #3306

About 5 to 7 hours of your hands, one day. Bob (the builder Mac, full Xcode) plus your browser, top to bottom.

This is the one place for everything iOS: every Apple-account step, every Xcode or simulator check, and everything Bob has to do for the iOS releases. It folds in #3191, #2923, #2908, #2905, #2886, #2898, #3152, #2912 and #2333, which are closed with a pointer here; their bodies stay as the long version. Part of #2875. New iOS owner-hands work goes in this issue as a checkbox, not a new issue.

Before you start (10 min)

• Bob is on, awake, and signed in to Xcode with your Apple ID (Xcode > Settings > Accounts). Note the Team ID.
• Comment the Team ID here: the universal-link file (/.well-known/apple-app-site-association, a 404 on the live site) needs it, and an agent adds it in a PR within minutes.
• Merge anything an agent has open for iOS first, then on Bob git pull and bun install --frozen-lockfile. brew install xcodegen if missing.

1. Bob: build and run (about 1 h)

• The shell (was MANUAL RUN: iOS test client (#2210) needs an Xcode simulator run #2333): bun run ios https://<any deployed app> --build builds, installs and opens it in a simulator. The app fills the screen; a link to another site opens Safari; the top-right arrow changes apps. Then cd native/ios && swift test.
• Park Hide & Seek build and tests (was MANUAL RUN: Bob: Park Hide & Seek iOS drop map on the builder Mac #2923, Park Hide & Seek iOS: compile the offline spike and run its tests on the builder #2918): cd apps/park-hide-seek/ios && DEVELOPMENT_TEAM=<id> xcodegen, swift test (includes testDropRuleKeepsOutTheCabinTheRimAndCliffs, testYouSeeYourAcceptedDrop, testACamperPicksTheirDropInTheEmbeddedRoom), build the App target in Xcode (never compiled before: expect small SwiftUI/RealityKit fixes).
• Offline in the simulator (was MANUAL RUN: Park Hide & Seek offline in the iOS simulator (spike for #2897) #2908): airplane mode, type a name, Play offline against AI. A round runs drop, hide, hunt, results; thumbstick, Run and Crouch work; terrain and people draw. Write down frame rate, one tick's cost (Instruments), app size, anything that felt bad.
• Drop map (was MANUAL RUN: Bob: Park Hide & Seek iOS drop map on the builder Mac #2923): in the 15 s drop phase tap a spot, see the flag, hide starts there. Tap red ground: nothing is sent. Repeat online.
• Run once on your own iPhone (cable, Developer Mode): Play offline, then Quick play against the live edge (bun run deploy in the app first if it is stale).

2. Apple side, in the browser (1 to 1.5 h)

• Records and upload key (was MANUAL RUN: App Store Connect records and an upload key for the iOS apps #2886): developer.apple.com Identifiers: bundle IDs for Park Hide & Seek (com.quinnscode.parkhideseek), Hippo Tycoon and qCRM. App Store Connect: app record for Park Hide & Seek. Users and Access > Integrations > Team Keys > +, name rustybuns-upload, access App Manager; download the .p8 once. Save the .p8, Key ID and Issuer ID in 1Password (one Password item each) and add ASC_KEY_P8, ASC_KEY_ID, ASC_ISSUER_ID as secrets in the drops environment. An Apple Distribution certificate and provisioning profile are needed too (the iOS lane PR iOS lane: SwiftUI shell, Rust xcframework, TestFlight in CI #2876 says whether the API key can make them or they need Xcode on Bob).
• Sign in with Apple (was MANUAL RUN: eqosys Sign in with Apple keys and App Review accounts #2898, with MANUAL RUN: eqosys signing key in 1Password, then deploy #2785): Services ID with Sign in with Apple, return URL https://eqosys.qntbr.com/api/auth/callback/apple, a key (.p8). bun apps/eqosys/scripts/apple-secret.ts <teamId> <keyId> <servicesId> < AuthKey.p8 prints the client secret (good six months). Put them in 1Password (eqosys vault, item apple, built-in password field per value), add the three APPLE_* bindings to apps/eqosys/rustybuns.config.ts with .env.schema, deploy eqosys. For each iOS app: bun apps/eqosys/scripts/review-account.ts <appId> <email> <password>, and put the account in App Store Connect's review notes.
• Privacy (was MANUAL RUN: App Store Connect privacy URL and privacy questions for each Q iOS app #3152), after eqosys is deployed with the privacy page: read https://eqosys.qntbr.com/privacy once. For each app in App Store Connect > App Privacy: Privacy Policy URL https://eqosys.qntbr.com/privacy; nutrition label from that page (Email Address, Name, Gameplay content, User ID, Diagnostics if the game sends reports; each linked to the user, not used for tracking). Link the same URL in the app's settings next to Delete account. About 15 min per app.

3. TestFlight (45 min plus Apple processing)

• On Bob: archive and upload (steps in apps/park-hide-seek/TESTFLIGHT.md); raise CURRENT_PROJECT_VERSION each time.
• Was MANUAL RUN: Park Hide & Seek iOS: build in Xcode, join a quick-play room from TestFlight #2905: install through TestFlight, join a quick-play room with a second phone or a friend, play against bots, open a ?room= link. The universal-link file and the eqosys iOS sign-in return (eqosys: in-app account deletion and Sign in with Apple, for the App Store #2879) must be in by now.

4. App Store (1 to 1.5 h, then Apple review 1 to 3 days)

• Listing text, screenshots (6.9" iPhone, 13" iPad), age rating, review notes (offline play needs no account).
• Was MANUAL RUN: Park Hide & Seek: put the real App Store link in STORE_URL #2912: send the real App Store link (https://apps.apple.com/app/id<number>) once Apple gives it; an agent replaces STORE_URL (apps/park-hide-seek/src/api.ts) and Edge.store (apps/park-hide-seek/ios/Sources/ParkKit/Rooms.swift).
• Add for Review, Submit.

Not in this block

Agent work, no hands needed yet: #2916 (real character models), #3153 (Sign in with Apple server notifications), #2883 Hippo Tycoon and #2884 qCRM on iOS, #3149 Splat spy to the App Store. When one of them needs your hands, it becomes a checkbox here. Left alone on purpose: #2441 is the Mac app's Developer ID signing, not iOS.