#46 Classify errors before credentials; no browser in the Apple journey (v1.64.16.0)

Live nimbus round 9, from the actual transcript: deliver failed on Apple's expanded age-rating questionnaire (missing lootBox/ageAssurance/parentalControls/messagingAndChat attributes — a Spaceship::UnexpectedResponse validation error), and the agent misdiagnosed it as an auth failure, demanded an app-specific password, then read THIRD-PARTY-ACTIONS.md and used its general browser-offer guidance to start driving Aside at account.apple.com.

Two rules added:

1. Error classification before credentials: only Apple's own words (401/403, session expired/invalid, "app-specific password") make an auth error; validation/missing-attribute errors are metadata fixes retried from the CLI.
2. APPLE-RELEASE explicitly overrides THIRD-PARTY-ACTIONS for the entire Apple journey — no browser, driven or manual, outside the named paid-app agreements/banking/tax residue.

Test evidence: test:gstack2 gate green (parity 4,359).

🤖 Generated with Claude Code

---

Summary by cubic

Fixes the Apple release flow by classifying errors before asking for credentials and banning browser steps in the Apple journey. Prevents false auth prompts and keeps uploads CLI-only except for paid-app agreements/banking/tax.

• Bug Fixes
  • Classify auth vs metadata errors: only explicit Apple auth signals (401/403, session expired/invalid, “app-specific password”) trigger credential prompts; validation/missing-attribute errors (e.g., lootBox, ageAssurance, parentalControls, messagingAndChat) are payload fixes retried from the CLI.
  • APPLE-RELEASE now overrides THIRD-PARTY-ACTIONS: no browser, driven or manual, in the Apple flow; the only exception is the paid-app agreements/banking/tax residue.
  • Updated skills/ship/references/APPLE-RELEASE.md and scripts/gstack2/generate-skill-tree.ts to enforce these rules; bumped to 1.64.16.0 with CHANGELOG.md updates.