# web-ios-android アプリ公開キット

> Web・iPhone・Android・Chrome拡張の公開準備を、AIと自動化で再実行可能な形で進めるテンプレートキット。

## Canonical pages

- Human landing page: https://kimito-skill.link/
- AI execution guide: https://kimito-skill.link/ai-guide/
- Current version and checks: https://kimito-skill.link/check-shindan-version/
- All documentation: https://kimito-skill.link/sitemap/

## Purpose

This kit centralizes app-specific inputs, prepares files and automation for selected platforms, verifies what can be verified, and reports the remaining human actions.

It does not decide the app concept, create external accounts, complete identity verification, pay fees, guarantee store approval, or treat unmeasured external state as successful.

## Required read order inside a downloaded repository

1. START-HERE.md
2. Root CLAUDE.md and/or AGENTS.md
3. app.config.json
4. Instructions for the selected platform(s)
5. Current git status, diagnostics, and handoff documents

Repository-local instructions and the user's latest instruction override this generic guide.

## Required inputs

- App name, purpose, and target users
- Selected platforms: Web / iPhone / Android / Chrome extension
- Contact, owner, and production domain
- Whether the app has payments, subscriptions, ads, or user data
- Existing store account IDs only when already obtained

Ask only for information that blocks the current step. Ask one clear question at a time. Never turn an example or placeholder into a confirmed value.

## Execution workflow

1. Inspect current state and preserve existing uncommitted work.
2. Validate app.config.json and separate confirmed, missing, and placeholder values.
3. Run only the setup needed for selected platforms.
4. Build, diagnose, and verify links and public pages.
5. For iPhone or Android, generate the splash assets, run `npm run splash:check`, and record the final real-device visual check separately.
6. When a web site is published, run `npm run security:score`. It must return both internal preflight score 100 and malwarecheck.site live score 100.
7. Request authority before external submission, payment, account creation, or messages.
8. Report completed work, uncompleted work, problems, human actions, and verification URLs.

## Safety boundaries

- Never publish secret values, keys, tokens, certificates, absolute local paths, or raw diagnostic logs.
- Never report unmeasured or inaccessible state as success.
- Never delete or overwrite unrelated user changes.
- Never reuse another app's domain, IDs, screenshots, or personal information.
- The malwarecheck.site scan receives only the already-public URL. Never send secrets or local files. A score of 100 is not a guarantee of safety.

## Definition of done

- The target app and target platforms are explicit.
- Generated files, settings, builds, and checks have evidence.
- For iPhone or Android, the splash static gates pass and the real-device visual result or its unverified status is explicit.
- Public URLs and primary navigation work when deployment is in scope.
- When web deployment is in scope, internal preflight and malwarecheck.site live scan both score 100.
- Human actions and AI actions are clearly separated.
- Unknowns, known issues, and limitations are visible.
- The final report lists: result, completed, uncompleted, problems, next human actions, and verification URLs.