Validate Sign in with Apple and iCloud/CloudKit paths

[zachyzissou]

Problem

Sign in with Apple was reported as not working, and CloudKit signing remains a separate risk area. We need a real validation pass across identity, entitlements, and cloud account state.

Acceptance criteria

• Verify Sign in with Apple on simulator and real device/TestFlight where possible.
• Confirm presentation anchor warnings/regressions remain gone.
• Confirm entitlement/profile state for app and widgets.
• Keep PR Re-enable CloudKit signing preflight #38 CloudKit signing separate unless its signing preflight passes.
• Add clear error copy for unavailable/restricted iCloud account states.

Notes

Do not merge CloudKit signing changes just because identity UI passes locally.

Agent execution contract

Readiness: agent:senior-required
Lane: Apple identity / CloudKit

Start in these files:

• OffScript/AppleIdentityService.swift
• OffScript/AppSettings.swift
• OffScript/OffScriptApp.swift
• OffScript.entitlements
• scripts/app_store_connect.py

Required verification:

• Simulator plus real-device/TestFlight Sign in with Apple checklist.
• CloudKit/signing preflight before any entitlement merge.

Non-goals / guardrails:

• Do not merge PR Re-enable CloudKit signing preflight #38 or CloudKit signing changes unless signing-preflight passes.
• Do not treat simulator-only identity success as full validation.

PR expectation: Senior Apple-platform PR with entitlement/profile evidence.

Low-thinking agents must follow docs/AGENT_EXECUTION_RUNBOOK.md. If the touched code falls outside the files above, stop and tighten the issue or ask for senior review before continuing.

[zachyzissou]

Status: needs real-device validation

Can never close from simulator-only work. Acceptance bullets require an actual iPhone with a signed-in iCloud account / real audio session interruption / lock-screen interaction. Recommend marking this with a 'real-device-required' status so it's clear this isn't pickup-able by a low-thinking agent regardless of available time.

Discovered while reviewing the kanban post-session 2026-04-30.