ci: skip native matrices for docs-only changes

.claude/commands/audit-iapkit.md

@@ -0,0 +1,130 @@
+---
+name: audit-iapkit
+description: Audit the IAPKit product surface against OpenIAP as the source of truth, then fix the drift it finds. Use when the user asks to check whether IAPKit reflects OpenIAP updates, audit kit docs, or reconcile kit.openiap.dev with openiap.dev.
+---
+
+# Audit IAPKit Against OpenIAP
+
+IAPKit is a deployable SaaS, not a library, so it sits outside the GQL type-sync
+chain that keeps the SDKs aligned. Nothing regenerates its site copy when the
+spec, the stores, or the SDKs move, so its documentation drifts silently. This
+workflow finds that drift and fixes it.
+
+Read `packages/kit/CONVENTION.md` before editing anything under `packages/kit`.
+
+## Direction of truth
+
+```text
+OpenIAP spec + packages/kit implementation   →   IAPKit site copy
+        (authoritative)                            (must follow)
+```
+
+Precedence when surfaces disagree: implementation > `packages/docs` >
+`packages/kit` prose. `packages/docs` outranks kit prose only where the code
+does not decide the question (product positioning, support claims). Never
+"fix" the code to match a doc without saying so explicitly.
+
+## Workflow
+
+```text
+1. Establish what changed upstream
+         ↓
+2. Check every prose claim against the implementation
+         ↓
+3. Check kit against packages/docs for contradictions
+         ↓
+4. Apply mechanical fixes; escalate product calls
+         ↓
+5. Verify
+```
+
+## Steps
+
+### 1. Establish what changed upstream
+
+```bash
+# Spec and SDK movement since the kit surface was last reviewed.
+git log --oneline -20 -- packages/gql/src/type.graphql openiap-versions.json
+# Least recently reviewed kit files first — that is where drift concentrates.
+for f in $(git ls-files packages/kit/src/pages/docs/sections packages/kit/src/content); do
+  echo "$(git log -1 --format='%ad' --date=short -- "$f")  $f"
+done | sort
+```
+
+Also check upstream store documentation for anything the kit pages describe:
+App Store Server API, Google Play Developer API, Amazon RVS, Meta Horizon, and
+the Vega SDK release notes.
+
+### 2. Check prose against the implementation
+
+This is the highest-value pass. For every checkable claim on the kit site, find
+the code that implements it and confirm the claim matches. Cite `file:line` for
+both sides.
+
+Highest-yield targets, in order:
+
+- **Verification order and cryptography** — `packages/kit/convex/purchases/*.ts`.
+  A page saying IAPKit verifies something it does not verify is the worst class
+  of error.
+- **Error codes** — confirm each documented code can actually reach a caller.
+  Codes raised internally and re-wrapped before the response must not be listed.
+- **Endpoints, fields, and limits** — `packages/kit/server/api/v1/**`,
+  especially `route-input-schemas.ts` for which fields are required. A field the
+  server requires but the docs call optional makes every following example 400.
+- **Negative verdicts that return 200** — outcomes that are not errors but are
+  documented as if they were, or not documented at all.
+- **Numbers** — retry counts, rate limits, size caps, file sizes, retention
+  windows. These rot silently; recompute rather than trusting the page.
+
+### 3. Check kit against `packages/docs`
+
+The two sites describe one product. Find statements that contradict each other
+and decide which side is right from the code, then fix the wrong side.
+
+```bash
+bun run audit:docs
+```
+
+### 4. Apply fixes, escalate decisions
+
+Fix mechanically when the correct text is determined by the code: a wrong fact,
+an unreachable error code, a stale number, a broken link, a naming violation.
+
+Escalate to the user, do not guess, when the fix requires a product call:
+what the product officially claims to support, support channels, pricing or
+plan statements, legal document content, restructuring a page, or consolidating
+pages that have published URLs.
+
+Constraints that override any finding:
+
+- **Production is read-only.** Never run a mutation or action against the
+  production Convex deployment, from the dashboard runner or anywhere else, and
+  never hand-edit production documents. Reads are fine when the user asks;
+  report aggregates, not customer emails. Full rule in the root `AGENTS.md`.
+- **Webhook direction.** The only supported direction is store → IAPKit. Never
+  document an IAPKit → SDK/mobile webhook, SSE, WebSocket, push relay, or
+  long-poll feed. See the root `AGENTS.md`.
+- **Brand.** `OpenIAP` and `IAPKit`, never `Open IAP`, `IAP Kit`, or bare `Kit`.
+- **Reader-first standard.** `knowledge/internal/05-docs-patterns.md`. Remove
+  filler and state each fact once; do not restyle prose that is already clear.
+- **Screenshots.** A figure that contradicts corrected text is worse than no
+  figure. Open the image before trusting its caption.
+
+### 5. Verify
+
+```bash
+bun run --filter @hyodotdev/openiap-kit lint
+bun run --filter @hyodotdev/openiap-kit test
+bun run --filter @hyodotdev/openiap-kit smoke:server
+bun run audit:kit-contract
+bun run audit:docs
+```
+
+`packages/kit` changes also trigger the CI-equivalent gate in
+`.husky/pre-commit`, which mirrors `deploy-kit.yml`.
+
+## Report
+
+Group findings as **fixed** (with file:line), **needs a decision** (with the
+options and your recommendation), and **rejected** (with the reason). Say
+plainly when a surface is in good shape rather than manufacturing work.

.claude/commands/verify-all.md

@@ -20,6 +20,10 @@ bun run audit:parity
 # Stable main / prerelease next branch contract.
 bun run audit:release-state
 node --test scripts/release-branch-policy.test.mjs
+
+# Native build / Swift CodeQL path filters.
+bun run audit:ci-paths
+bun run audit:agents
 ```
 
 This fails if a new non-Godot library, Expo example route/product ID, generated
@@ -318,6 +322,8 @@ set -euo pipefail
 (cd scripts/agent && bun run compile:ai && bun test && bun run typecheck)
 bun run audit:parity
 bun run audit:release-state
+bun run audit:ci-paths
+bun run audit:agents
 bun test \
   --path-ignore-patterns='**/build/**' \
   --path-ignore-patterns='**/.build/**' \

.claude/skills/openiap-workflows/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: openiap-workflows
-description: Use for OpenIAP monorepo work that should follow the repository's slash-command workflows when the user asks in natural language instead of typing a slash command, including review-pr, audit-code, compile-knowledge, verify-all, e2e-tests, stable or prerelease package releases, resolve-issue, commit/push/PR, generated type sync, package-specific checks, GitHub review threads, and project conventions from AGENTS.md.
+description: Use for OpenIAP monorepo work that should follow the repository's slash-command workflows when the user asks in natural language instead of typing a slash command, including review-pr, audit-code, audit-security, audit-iapkit, compile-knowledge, verify-all, e2e-tests, stable or prerelease package releases, resolve-issue, commit/push/PR, generated type sync, package-specific checks, GitHub review threads, and project conventions from AGENTS.md.
 ---
 
 # OpenIAP Workflows (Claude Code)
@@ -20,6 +20,8 @@ reading the command file (or invoke the slash command directly when available):
   bots, and remove temporary CodeRabbit trigger and terminal
   skip/unavailable top-level comments when the loop is clean
 - Audit code against knowledge rules → `.claude/commands/audit-code.md` (`/audit-code`)
+- Audit supply-chain security / SBOM → `.claude/commands/audit-security.md` (`/audit-security`)
+- Reconcile IAPKit with OpenIAP → `.claude/commands/audit-iapkit.md` (`/audit-iapkit`)
 - Compile knowledge / rebuild AI context → `.claude/commands/compile-knowledge.md` (`/compile-knowledge`)
 - Resolve a GitHub issue → `.claude/commands/resolve-issue.md` (`/resolve-issue`)
 - Verify all / monorepo health check → `.claude/commands/verify-all.md` (`/verify-all`)

.codex/skills/openiap-workflows/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: openiap-workflows
-description: Use for OpenIAP monorepo work that should follow the repository's shared agent workflows, including review-pr, audit-code, compile-knowledge, verify-all, e2e-tests, stable or prerelease package releases, resolve-issue, commit/push/PR, generated type sync, package-specific checks, GitHub review threads, and project conventions from AGENTS.md.
+description: Use for OpenIAP monorepo work that should follow the repository's shared agent workflows, including review-pr, audit-code, audit-security, audit-iapkit, compile-knowledge, verify-all, e2e-tests, stable or prerelease package releases, resolve-issue, commit/push/PR, generated type sync, package-specific checks, GitHub review threads, and project conventions from AGENTS.md.
 ---
 
 # OpenIAP Workflows
@@ -40,6 +40,8 @@ natural-language requests, execute the matching workflow:
   `.claude/commands/audit-code.md`.
 - Audit SBOM quality, release provenance, workflow permissions, or
   supply-chain/security posture: read `.claude/commands/audit-security.md`.
+- Reconcile the IAPKit site with OpenIAP, audit kit docs, or check whether
+  IAPKit reflects a spec/store update: read `.claude/commands/audit-iapkit.md`.
 - Compile knowledge or rebuild AI context: read
   `.claude/commands/compile-knowledge.md`.
 - Resolve a GitHub issue: read `.claude/commands/resolve-issue.md`.

.github/workflows/ci-expo-iap.yml

@@ -9,8 +9,10 @@ on:
       - "packages/apple/Sources/**"
       - "packages/apple/Package.swift"
       - "openiap-versions.json"
+      - "libraries-versions.jsonc"
       - "codecov.yml"
       - ".github/workflows/ci-expo-iap.yml"
+      - "!**/*.md"
   push:
     branches: [main, next]
     paths:
@@ -19,8 +21,10 @@ on:
       - "packages/apple/Sources/**"
       - "packages/apple/Package.swift"
       - "openiap-versions.json"
+      - "libraries-versions.jsonc"
       - "codecov.yml"
       - ".github/workflows/ci-expo-iap.yml"
+      - "!**/*.md"
 
 permissions:
   contents: read

.github/workflows/ci-flutter-inapp-purchase.yml

@@ -9,9 +9,11 @@ on:
       - "packages/apple/Sources/**"
       - "packages/apple/Package.swift"
       - "openiap-versions.json"
+      - "libraries-versions.jsonc"
       - "codecov.yml"
       - ".github/workflows/ci-flutter-inapp-purchase.yml"
       - ".github/workflows/release-flutter.yml"
+      - "!**/*.md"
   push:
     branches: [main, next]
     paths:
@@ -20,9 +22,11 @@ on:
       - "packages/apple/Sources/**"
       - "packages/apple/Package.swift"
       - "openiap-versions.json"
+      - "libraries-versions.jsonc"
       - "codecov.yml"
       - ".github/workflows/ci-flutter-inapp-purchase.yml"
       - ".github/workflows/release-flutter.yml"
+      - "!**/*.md"
 
 permissions:
   contents: read
@@ -111,12 +115,12 @@ jobs:
         run: bash scripts/verify-apple-swiftpm-consumer-build.sh
 
   apple-cocoapods:
-    name: iOS CocoaPods consumer (Flutter 3.44 + Xcode 16.4)
+    name: iOS CocoaPods consumer (Flutter 3.44 + Xcode 26.6)
     if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: macos-15
+    runs-on: macos-26
     timeout-minutes: 60
     env:
-      XCODE_VERSION: 16.4
+      XCODE_VERSION: 26.6
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:

.github/workflows/ci-godot-iap.yml

@@ -10,6 +10,8 @@ on:
       - "libraries/godot-iap/**"
       - "packages/gql/codegen/plugins/gdscript.ts"
       - "packages/gql/src/generated/types.gd"
+      - "openiap-versions.json"
+      - "!**/*.md"
   push:
     branches: [main, next]
     paths:
@@ -19,6 +21,8 @@ on:
       - "libraries/godot-iap/**"
       - "packages/gql/codegen/plugins/gdscript.ts"
       - "packages/gql/src/generated/types.gd"
+      - "openiap-versions.json"
+      - "!**/*.md"
 
 permissions:
   contents: read

.github/workflows/ci-kmp-iap.yml

@@ -9,6 +9,7 @@ on:
       - "openiap-versions.json"
       - "scripts/ci/retry-gradle.sh"
       - ".github/workflows/ci-kmp-iap.yml"
+      - "!**/*.md"
   push:
     branches: [main, next]
     paths:
@@ -17,6 +18,7 @@ on:
       - "openiap-versions.json"
       - "scripts/ci/retry-gradle.sh"
       - ".github/workflows/ci-kmp-iap.yml"
+      - "!**/*.md"
 
 permissions:
   contents: read
@@ -66,7 +68,7 @@ jobs:
 
   ios-compile-check:
     name: iOS Compile Check
-    runs-on: macos-15
+    runs-on: macos-26
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

.github/workflows/ci-maui-iap.yml

@@ -13,6 +13,7 @@ on:
       - "openiap-versions.json"
       - "scripts/ci/retry-gradle.sh"
       - ".github/workflows/ci-maui-iap.yml"
+      - "!**/*.md"
   push:
     branches: [main, next]
     paths:
@@ -25,6 +26,7 @@ on:
       - "openiap-versions.json"
       - "scripts/ci/retry-gradle.sh"
       - ".github/workflows/ci-maui-iap.yml"
+      - "!**/*.md"
 
 permissions:
   contents: read

.github/workflows/ci-react-native-iap.yml

@@ -9,8 +9,10 @@ on:
       - "packages/apple/Sources/**"
       - "packages/apple/Package.swift"
       - "openiap-versions.json"
+      - "libraries-versions.jsonc"
       - "codecov.yml"
       - ".github/workflows/ci-react-native-iap.yml"
+      - "!**/*.md"
   push:
     branches: [main, next]
     paths:
@@ -19,8 +21,10 @@ on:
       - "packages/apple/Sources/**"
       - "packages/apple/Package.swift"
       - "openiap-versions.json"
+      - "libraries-versions.jsonc"
       - "codecov.yml"
       - ".github/workflows/ci-react-native-iap.yml"
+      - "!**/*.md"
 
 permissions:
   contents: read

.github/workflows/ci.yml

@@ -13,8 +13,13 @@ on:
 permissions:
   contents: read
 
+# Cancel the superseded run on every PR push; main pushes always run to completion.
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 env:
-  XCODE_VERSION: 16.4
+  XCODE_VERSION: 26.6
 
 jobs:
   audit-release-state:
@@ -153,6 +158,8 @@ jobs:
         uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4
         id: filter
         with:
+          # Without this, '!' patterns are OR-ed positives that match nearly everything.
+          predicate-quantifier: some-with-excludes
           filters: |
             gql:
               - 'packages/gql/**'
@@ -163,18 +170,21 @@ jobs:
               - 'openiap-versions.json'
               - '.github/workflows/ci.yml'
               - 'libraries/maui-iap/src/OpenIap.Maui/Types.cs'
+              - '!**/*.md'
             android:
               - 'packages/google/**'
               - 'packages/gql/**'
               - 'scripts/**'
               - 'openiap-versions.json'
               - '.github/workflows/ci.yml'
+              - '!**/*.md'
             ios:
               - 'packages/apple/**'
               - 'packages/gql/**'
               - 'scripts/**'
               - 'openiap-versions.json'
               - '.github/workflows/ci.yml'
+              - '!**/*.md'
             docs:
               - 'packages/docs/**'
               - 'packages/gql/src/generated/**'
@@ -291,6 +301,12 @@ jobs:
       - name: Run IAPKit spec contract audit
         run: node scripts/audit-kit-spec-contract.mjs
 
+      - name: Audit CI path filters
+        run: npm run audit:ci-paths
+
+      - name: Audit agent surfaces
+        run: npm run audit:agents
+
   test-gql:
     name: Test GQL Types
     runs-on: ubuntu-latest
@@ -388,9 +404,9 @@ jobs:
 
   test-ios:
     name: Test iOS
-    runs-on: macos-15
     needs: changes
     if: needs.changes.outputs.ios == 'true'
+    runs-on: macos-26
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7