Mobile App Provisioning

Use this for complete, auditable mobile app setup. The goal is not "enough to build once"; the goal is a credential and store posture that will not haunt the project later.

Defaults

• Prefer the browser the user named. If they say Helium, use Helium.
• Keep a markdown session/handoff file in the repo, usually scratchpad/<app>-store-auth-preflight-YYYY-MM-DD.md.
• Store secret files under scratchpad/credentials/ unless the user gives another secure path.
• Never paste private keys, passwords, .p8, .p12, service account JSON contents, or keystore passwords in chat or notes.
• Record file paths, IDs, expiry dates, account/team names, selected permissions, and exact pending blockers.
• Confirm at action-time before creating long-lived API keys, service account keys, OAuth keys, or granting external account access.
• Use least privilege unless the user explicitly wants broader release automation.

Load When Needed

• For the concrete checklist, read references/checklist.md.
• For the final note format, read references/handoff-template.md.