docs: refresh public presence and App Store drafts

docs/APP_STORE_METADATA_DRAFT.md

@@ -42,6 +42,10 @@ Install CodePilot on a Mac that already runs Codex CLI, create a saved account p
 
 Please report whether Cloudflare Tunnel setup, gateway connection, token entry, or localhost link opening was the step that failed. Remove account names, gateway URLs, tokens, hostnames, localhost or local-web session URLs, local page contents, local paths, private prompts, screenshots, and logs containing private data before sharing feedback.
 
+## Review Notes
+
+CodePilot is a companion for people who already run Codex CLI on a Mac they control. No CodePilot account or demo credentials are required. The app opens without a gateway and shows connection setup guidance. Connected features require a user-controlled Mac running the CodePilot gateway, an HTTPS Cloudflare Tunnel URL, and its gateway token. Remote Desktop is disabled and is not part of this beta. The support documentation explains the setup and privacy model.
+
 ## Support URL
 
 Requires maintainer approval before TestFlight external testing or App Store submission. Candidate destination after GitHub Pages is enabled and verified: `https://codepilotios.github.io/codepilot/SUPPORT.html`.
@@ -68,4 +72,5 @@ See the [App Store screenshot checklist](../metadata/screenshots/README.md).
 - Age rating.
 - Export compliance.
 - TestFlight external testing and App Store review submission.
+- Final App Review notes and reviewer access path.
 - Pricing, subscription, or commercial-use claims.

docs/CHANGELOG.md

@@ -4,6 +4,7 @@
 
 ### Public Beta Preparation
 
+- Kept maintainer-only App Store setup guidance and community promotion drafts out of the generated GitHub Pages site, with an automated exclusion check.
 - Added GitHub Pages configuration and narrowed the generated site to user-facing beta documentation.
 - Refined the Pages landing page with beta scope, security guidance, and install prerequisites.
 - Added public-safe GitHub feature request and pull request templates for beta feedback and contribution review.
@@ -31,7 +32,7 @@
 - Added concrete draft support and privacy URLs that remain gated on GitHub Pages enablement and maintainer verification.
 - Added the missing repository checkout step and documented the supported macOS 13 and iOS 17 minimums for beta setup.
 - Reframed Remote Desktop support categories as availability-guard reports so the gated feature is not presented as a supported beta workflow.
-- Expanded the beta privacy draft to disclose Cloudflare data transit, notification and Live Activity payload contents, and the lack of automatic upload cleanup.
+- Expanded the beta privacy draft to disclose Cloudflare data transit, notification and Live Activity payload contents, and the gateway's seven-day upload cleanup behavior.
 - Clarified that the local gateway does not make Codex workflows offline: prompts, conversation context, and selected attachments can still be processed by OpenAI, while Cloudflare and Apple process data only for the enabled tunnel and notification workflows.
 - Added a consistent fictional-data capture brief and full-resolution acceptance checklist for the approved public beta screenshot set.
 - Added a public beta data-flow map showing what stays on the Mac and what can be processed by Codex, OpenAI, Cloudflare, or Apple.
@@ -55,6 +56,9 @@
 - Aligned privacy, FAQ, iOS setup, and troubleshooting copy with the gateway's seven-day upload-retention cleanup behavior.
 - Reconciled the versioned App Store and TestFlight drafts with the approved Codex CLI beta positioning, supported feature set, and privacy-safe feedback guidance.
 - Added the public-presence audit to CI and made canonical App Store metadata drift or blocked Remote Desktop enablement copy fail the check.
+- Replaced placeholder support and privacy URLs in the versioned App Store metadata with the approved GitHub Pages candidates, and made URL drift from the human-readable draft fail the public-presence audit.
+- Aligned the App Store screenshot checklist with the public demo-data brief and added full-resolution privacy checks for window chrome, local-web previews, and unrelated device content.
+- Replaced the versioned App Review notes placeholder with a beta-scoped local draft and added length and drift checks, while keeping final reviewer access and submission approval-gated.
 
 ### Recent Product Work
 

docs/_config.yml

@@ -6,11 +6,13 @@ show_downloads: false
 # Keep planning, operations, and submission drafts in the repository without
 # publishing them as part of the user-facing GitHub Pages site.
 exclude:
+  - APP_STORE_CONNECT_SETUP.md
   - APP_STORE_METADATA_DRAFT.md
   - PRODUCTION_READINESS.md
   - PRODUCTION_READINESS_IMPLEMENTATION_PLAN.md
   - PUBLIC_PRESENCE_CHECKLIST.md
   - RELEASE_CHECKLIST.md
   - SCREENSHOTS.md
+  - community
   - operations
   - superpowers

metadata/screenshots/README.md

@@ -4,17 +4,26 @@ No App Store-ready screenshots are currently present in the repository.
 
 The minimum practical submission set is 1–10 screenshots for the 6.9-inch iPhone display. Use an accepted portrait canvas such as 1320×2868, 1290×2796, or 1260×2736 pixels. Export PNG or JPEG files without alpha or transparency. No iPad set is required for the current iPhone-only target.
 
+Use one fictional workspace across the set:
+
+- Account names: `Work`, `Personal`, and `Demo`.
+- Gateway hostname: `codepilot.example.com`.
+- Thread names: `Review parser tests`, `Improve setup copy`, and `Triage upload error`.
+- Sample files: `sample-diff.txt` and `wireframe.png`, created only for capture.
+
 Prepare approved screenshots for:
 
 - First connection screen with the Cloudflare connection choice.
 - Gateway health or setup status after a successful connection.
 - Total-credit status with synthetic account names and balances.
 - Total Credit Live Activity on a supported Lock Screen or Dynamic Island.
 - Thread list or active turn view.
-- File preview from a local Mac path.
-- Local Mac web page opened through the gateway.
+- File upload confirmation using a non-sensitive sample file, without showing a local path.
+- Purpose-built loopback demo page opened through the gateway, without showing its URL, source code, logs, paths, or query values.
 - Error recovery state with non-sensitive copy.
 
 Do not include Remote Desktop in the 0.1 screenshot set while its paired-device and session-authorization protections remain release-blocked.
 
-All screenshots must avoid real tokens, private hostnames, private account names, private file paths, private emails, and personal identifiers.
+Capture only the app or simulator window. Exclude desktop content, unrelated menu bar items, browser history, other-app notifications, device names, and unrelated windows. Inspect every full-resolution export, including status bars and window edges.
+
+All screenshots must avoid real tokens, private hostnames, private account names, private file paths, private emails, Apple or signing identifiers, repository names, private prompts, uploaded files, connected personal services, and personal identifiers. Run `scripts/privacy-audit.sh` before committing any image or screenshot metadata.

metadata/version/0.1/en-US.json

@@ -7,7 +7,7 @@
   "promotionalText": "Public beta for Codex CLI users: check usage and threads, upload files, and steer coding sessions running on a Mac you control.",
   "description": "CodePilot is a Mac menu bar app, local gateway, and iPhone companion for AI coding users who already run Codex CLI on a Mac.\n\nUse the iPhone app to check active account status, follow threads, upload files, open loopback web previews, steer or stop supported turns, receive optional turn-finished notifications, and connect through your own Cloudflare Tunnel setup. The Mac stays in your control, and the current beta does not require a hosted CodePilot account service.\n\nThe beta is focused on setup clarity, connection reliability, privacy-safe diagnostics, and practical remote workflows for existing Codex CLI users. Some internals still use legacy Codex-specific names, and support for other coding agents is not part of the current beta.\n\nCodePilot handles local coding-agent credentials and gateway access. Coding prompts and selected attachments are still processed through Codex and OpenAI according to the user's Codex account and configuration. Review the privacy, security, install, and support docs before exposing the gateway outside your local network.",
   "whatsNew": "See your total remaining Codex credit at a glance with a Live Activity, and use an available reset credit for the account you choose without returning to your Mac.\n\nNew:\n- Track combined available credit across configured accounts from the Lock Screen and Dynamic Island.\n- Use a rate-limit reset credit for a specific account after a clear confirmation.\n\nImproved:\n- Clearer gateway recovery when a token is missing, the gateway is offline, or authentication needs attention.\n- Better file previews for local paths and Markdown links.\n- Clearer account status and turn controls.\n\nFixed:\n- More stable gateway event formatting, turn-state handling, and background-session cleanup.\n- More reliable per-account credit refresh and reset state after manual account switches.",
-  "supportUrl": "TODO: maintainer-provided support URL",
-  "privacyPolicyUrl": "TODO: maintainer-provided privacy policy URL",
-  "reviewNotes": "TODO: add maintainer-approved review notes, demo prerequisites, and any required compliance details before upload."
+  "supportUrl": "https://codepilotios.github.io/codepilot/SUPPORT.html",
+  "privacyPolicyUrl": "https://codepilotios.github.io/codepilot/PRIVACY.html",
+  "reviewNotes": "CodePilot is a companion for people who already run Codex CLI on a Mac they control. No CodePilot account or demo credentials are required. The app opens without a gateway and shows connection setup guidance. Connected features require a user-controlled Mac running the CodePilot gateway, an HTTPS Cloudflare Tunnel URL, and its gateway token. Remote Desktop is disabled and is not part of this beta. The support documentation explains the setup and privacy model."
 }

ops/agents/escalations/presence-maintenance.md

@@ -12,7 +12,7 @@ The following public-publishing decisions are approved:
 
 ## Pending Maintainer Action
 
-Reverified on 2026-07-19. The public repository review found four launch-readiness settings that require maintainer access, one legal-content decision, and one unresolved release blocker:
+Reverified on 2026-07-22. The read-only live presence audit still reports seven failures: the repository description, repository website field, GitHub Pages configuration, private vulnerability reporting, and the landing, privacy, and support URLs. GitHub issues #25 and #27 also remain open. These map to four launch-readiness settings that require maintainer access, one legal-content decision, and one unresolved release blocker:
 
 Repository-setting follow-up is tracked in GitHub issue #27.
 

scripts/public-presence-audit.sh

@@ -30,6 +30,25 @@ unless missing_links.empty?
   exit 1
 end
 
+pages_config = File.read("docs/_config.yml")
+[
+  "APP_STORE_CONNECT_SETUP.md",
+  "APP_STORE_METADATA_DRAFT.md",
+  "PRODUCTION_READINESS.md",
+  "PRODUCTION_READINESS_IMPLEMENTATION_PLAN.md",
+  "PUBLIC_PRESENCE_CHECKLIST.md",
+  "RELEASE_CHECKLIST.md",
+  "SCREENSHOTS.md",
+  "community",
+  "operations",
+  "superpowers"
+].each do |private_pages_path|
+  next if pages_config.match?(/^\s*- #{Regexp.escape(private_pages_path)}\s*$/)
+
+  warn "public presence audit failed: docs/_config.yml does not exclude #{private_pages_path} from GitHub Pages"
+  exit 1
+end
+
 metadata_path = "docs/APP_STORE_METADATA_DRAFT.md"
 metadata = File.read(metadata_path)
 metadata_values = {}
@@ -55,7 +74,7 @@ metadata_values = {}
   metadata_values[heading] = value
 end
 
-{"Description" => 4_000, "What To Test" => 4_000}.each do |heading, field_limit|
+{"Description" => 4_000, "What To Test" => 4_000, "Review Notes" => 4_000}.each do |heading, field_limit|
   value = metadata[/^## #{Regexp.escape(heading)}\n\n(.*?)(?=\n## |\z)/m, 1]&.strip
 
   unless value
@@ -79,14 +98,33 @@ version_metadata = JSON.parse(File.read("metadata/version/0.1/en-US.json"))
   "Subtitle" => "subtitle",
   "Promotional Text" => "promotionalText",
   "Description" => "description",
-  "Keywords" => "keywords"
+  "Keywords" => "keywords",
+  "Review Notes" => "reviewNotes"
 }.each do |heading, json_key|
   next if version_metadata[json_key] == metadata_values[heading]
 
   warn "public presence audit failed: versioned #{json_key} does not match #{heading} in #{metadata_path}"
   exit 1
 end
 
+{
+  "Support URL" => "supportUrl",
+  "Privacy URL" => "privacyPolicyUrl"
+}.each do |heading, json_key|
+  section = metadata[/^## #{Regexp.escape(heading)}\n\n(.*?)(?=\n## |\z)/m, 1]
+  candidate_url = section&.match(/Candidate destination[^:]*: `([^`]+)`/)&.captures&.first
+
+  unless candidate_url
+    warn "public presence audit failed: candidate #{heading.downcase} is missing from #{metadata_path}"
+    exit 1
+  end
+
+  next if version_metadata[json_key] == candidate_url
+
+  warn "public presence audit failed: versioned #{json_key} does not match the candidate URL in #{metadata_path}"
+  exit 1
+end
+
 
 remote_desktop_setup_files = ["docs/INSTALL_MAC.md", "docs/INSTALL_IOS.md", "docs/TROUBLESHOOTING.md"]
 remote_desktop_enablement_patterns = [