Skip to content

Sample agent report

These five rows come from an archived Claude Code audit of a real Expo repository using pack v0.1.1. The app name is withheld. The complete run covered 28 checks: 11 passed, 2 failed and 15 remained unresolved.

The included pack is v0.3.2 with 31 checks. This is evidence of an earlier run, not current cross-agent certification. A repository finding does not establish App Store Connect state or final-device behavior.

IDENTITY-001VERIFIED PASS

name, slug, version, ios.bundleIdentifier and ios.buildNumber all present and non-empty.

Evidence: app.json
PERMISSION-002VERIFIED PASS

Camera string names menu-allergen scanning; photo-library string names menu-photo analysis — concrete benefits.

Evidence: app.json
COMPAT-002VERIFIED FAIL

patchedDependencies pins react-native@0.79.2, but 0.81.5 is installed; one dependency is a different SDK major from the rest.

Evidence: package.json
PERMISSION-003UNRESOLVED

Several permission-capable dependencies have no committed usage string; the native build may inject defaults.

Evidence: app.json, package.json
ARTIFACT-001UNRESOLVED

No .ipa or .app supplied, so DTPlatformName cannot be verified. Provide the exact submission artifact.

Evidence: —

Internal fixture report

Evidence-backed example

A separate example shows how the internal test checker handles a deliberately flawed fixture. Below is the complete, unedited output of Verto's deterministic internal QA checker (scripts/internal-preflight.mjs) run against the fixture at fixtures/expo-preflight-sample. It regenerates on every build, so what you read here is always what the alpha currently produces.

What this is and is not. This is the report format — the three status classes, the evidence column, the bounded verdict — produced by the internal checker Verto uses to test the pack against a deliberately broken example app. It is not the pack's own output, and it covers fewer items: the shipped pack asks your agent for 31 checks and 30 failure rules in one table. Treat this page as the shape of the document you get, not its length.

The decision is never a customer-facing ship-or-not certainty. It is one of critical risks, unresolved checks, or no deterministic blockers, and every result is separated into what the tool verified automatically, what a developer confirmed, and what still needs confirmation. That separation is the point: it keeps a developer's word distinct from proof, and it refuses to guess about anything it cannot see — like the state of your App Store Connect account.

CRITICAL-RISKS

1 deterministic blocker must be resolved before submission.

1Blockers2Needs input7Checks
Automatically verified3

Checks the tool proved from your project and build.

Developer-confirmed8

External steps you confirmed. Your word, kept separate from what the tool verified.

Needs confirmation2

Nobody has confirmed these yet. The report will not guess.

TargetTrailmarkGenerated byinternal-preflight-alpha v0.1.0 — expanded internal alphaFixture hashsha256:f972d384ac20f30dGenerated2026-10-21
Check 01Verified

iOS app identity

Check 02Blocker

iOS permission explanations

Check 03Verified

Expo package compatibility

Check 04Verified

App Store listing metadata

Check 05Needs confirmation

Subscription submission wiring

Check 06Needs confirmation

iOS build artifact (final Info.plist)

Check 07Verified

Developer-confirmed submission checklist

  • Blocker

    NSContactsUsageDescription has no matching package or plugin

    purpose-strings-01
    Where
    fixtures/expo-preflight-sample/app.json expo.ios.infoPlist.NSContactsUsageDescription
    Found
    Trailmark uses your contacts so you can invite friends to a shared hike.
    Fix
    Delete the key if unused, or confirm the project actually includes one of: expo-contacts.
    App Store Review Guideline 2.3
  • Needs confirmation

    Purchase SDK found but App Store subscription attachment cannot be verified

    subscription-wiring-02
    Where
    fixtures/expo-preflight-sample/package.json dependencies
    Found
    react-native-purchases
    Confirm
    A repository cannot prove App Store Connect attachment state. Verify the products on the submitted version, or pass the internal attachment manifest explicitly.
  • Needs confirmation

    iOS build artifact was not supplied

    ios-artifact-03
    Found
    (absent)
    Confirm
    Pass --ios-artifact <path> pointing at the built .app directory or .ipa so the final Info.plist can be verified. Repository config alone does not prove what shipped.

Internal dogfood build. Repository findings are real; checks requiring App Store Connect are explicitly marked needs-input when no export is supplied.

Download raw JSON

Audit the source

Provenance

A sample report is only worth anything if you can check it. Everything the report reads is committed in this repository:

  • fixtures/expo-preflight-sample/README.md — names the fixture's origin and lists every intentional mutation in a table mapped to the check that catches it.
  • fixtures/expo-preflight-sample/app.json
  • fixtures/expo-preflight-sample/package.json
  • fixtures/expo-preflight-sample/store.config.json
  • fixtures/expo-preflight-sample/checklist.json
  • scripts/internal-preflight.mjs — the checker itself, with the version-pairing table and Apple limits written as constants you can read.

What the fixture is

It is synthetic. "Trailmark" is a fictional hiking app. No file was taken from a real, client, or third-party app, and nothing proprietary is in it. The shape of the config follows the public Expo documentation defaults; the failure categories are drawn from publicly documented App Review causes. The fixture ships a store config and a filled-in submission checklist but no built .ipa, so the sample legitimately shows every verification class.

What these checks are not

They read your committed files and, when supplied, your final build's Info.plist. They do not talk to App Store Connect, use any network, or run on device. Where the answer is not deterministically inferable — a subscription's attachment state, a reviewer step, an Expo SDK outside the pinned pairing table — the report marks it needs confirmation instead of guessing. A preflight that cries wolf gets ignored, and an ignored check is worse than no check.

Determinism

The same fixture bytes produce the same findings in the same order on every run. The report embeds a sha256:f972d384ac20f30d hash of its inputs so a report can always be tied back to the exact files that produced it.

Read the founding terms