swift-gui-verifiable-loop — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited swift-gui-verifiable-loop (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when an agent (Codex CLI, Claude Code, Xcode agent) is implementing or refactoring SwiftUI GUI code on:
and you need a machine-verifiable iteration loop:
1) change code 2) run deterministic checks 3) capture immutable evidence 4) decide next step strictly from evidence
This skill prioritizes deterministic CLI artifacts over “eyeballing” GUI outcomes.
Versioning note:
A reliable GUI loop is typically hybrid:
.xcresult bundle and derive summaries/attachments from it.App.xcworkspace or App.xcodeproj (optional when scripts/ui/ui_loop.sh can auto-discover one at the package root)AppSmoke (a .xctestplan attached to the scheme)platform=macOS (optionally include arch=arm64 or arch=x86_64)platform=iOS Simulator,name=<device>,OS=<version> (prefer a simulator UDID when you need strict repeatability)--package-root <dir> when the script should search somewhere other than the repo root for a package/Xcode containerKeep these as constants in your project docs (e.g., AGENTS.md) so agents never guess.
If the target project already has an older copied scripts/ui/ui_loop.sh, refresh the managed scripts before using newer options:
/path/to/swift-gui-verifiable-loop/scripts/project/update_ui_loop_tools.sh \
--apply \
--platform macos \
/path/to/target-repoUse --platform ios for iOS-only apps and --platform both for shared macOS/iOS repos. This updater is intentionally limited to the skill-owned scripts; update project docs and test launch harnesses separately.
Do this once, then keep enforcing it.
@Observable view-models) or a reducer architecture (e.g., TCA).(Details + templates: see references/REFERENCE.md and assets/templates/.)
Use the orchestrator script (recommended).
macOS example:
scripts/ui/ui_loop.sh \
--scheme App \
--test-plan SmokeAgent-safe macOS UI example (preferred when full-screen XCTest screenshots are a concern):
scripts/ui/ui_loop.sh \
--workspace App.xcworkspace \
--scheme App \
--test-plan Smoke \
--destination 'platform=macOS' \
--reuse-build \
--system-attachment-lifetime keepNever \
--sanitize-screenshots keep \
--delete-raw-attachmentsiOS Simulator example:
scripts/ui/ui_loop.sh \
--scheme App \
--test-plan Smoke \
--destination 'platform=iOS Simulator,name=iPhone 16,OS=18.0'(For iOS 26 environments, use OS=26.0 in the destination.)
Outputs per run:
<artifacts-dir>/<run-id>/results.xcresult (immutable evidence)<artifacts-dir>/<run-id>/toolchain.txt (environment fingerprint)<artifacts-dir>/<run-id>/summary.json (machine-readable test summary)<artifacts-dir>/<run-id>/xcodebuild-*.log (captured xcodebuild logs unless VERBOSE=1)<artifacts-dir>/<run-id>/attachments/** (exported screenshots/attachments; sanitized when --sanitize-screenshots is used)<artifacts-dir>/<run-id>/attachments_raw/** (raw export only when screenshot sanitization is enabled and raw deletion is not requested)<artifacts-dir>/<run-id>/attachment_sanitization.json (sanitizer report when a transforming policy is used)<artifacts-dir>/<run-id>/xctestrun-attachment-policy.json (.xctestrun patch report when attachment lifetime policy is patched)<artifacts-dir>/<run-id>/diagnostics/** (crash logs, diagnostics)Default artifacts dir: ./.artifacts/ui (add /.artifacts/ to your project’s .gitignore).
If you prefer manual commands, see references/xcresult-bundles.md.
references/macos-ui-testing-permissions.md.(for example a GhostVM xcode-ui-ready snapshot) over repeatedly running on a real host that still needs interactive approval.
.xcresult, capture TCC attribution with scripts/macos/tcc_attribution_tail.sh, try the documented mitigations once, then ask the human or MDM policy owner to grant the OS permission instead of repeatedly rerunning.--reuse-build --system-attachment-lifetime keepNever --sanitize-screenshots keep --delete-raw-attachments after UI tests attach only app-window/root-element screenshots or cropped status-surface screenshots. Use redact-suspect only when privacy is more important than readable PNG evidence. See references/artifact-privacy.md.simctl. See references/ios-simulator-determinism.md.Recommended: Point-Free SnapshotTesting (see references/snapshot-testing.md).
.fixed / .sizeThatFits layouts..device(config: ...)) are fine, but only deterministic when you pin the simulator runtime + device model.Policy:
Templates:
assets/templates/SnapshotTestTemplate.swiftassets/templates/iOSSnapshotTestTemplate.swiftAdd at least one audit per major screen family:
try app.performAccessibilityAudit()This produces a high-signal, machine-actionable gate.
On macOS, be prepared to ignore narrowly-scoped host/framework noise with an explicit closure when the audit traverses synthetic SwiftUI container nodes or system-owned controls (for example, Touch Bar items) that are outside your app's actionable surface.
Template: assets/templates/AccessibilityAuditUITestTemplate.swift Reference: references/accessibility-audit.md
UI tests are valuable, but operationally fragile. Use them as proof-of-life flows:
NSStatusItem clicks are not hittable under XCUITestTemplates:
assets/templates/XCUITestLaunchHarnessTemplate.swift (uses click() and shows menu patterns)assets/templates/MacOSMenuBarExtraUITestTemplate.swiftassets/templates/iOSXCUITestLaunchHarnessTemplate.swift (uses tap() and includes a basic interruption monitor)In UI tests, attach:
XCUIApplication.screenshot() only after confirming it is app-scoped on that platform/runner, and avoid XCUIScreen.main.screenshot() for macOS agent runs.xcresult already stores these; export them after each run.
Templates: assets/templates/XCUITestLaunchHarnessTemplate.swift, assets/templates/AgentSafeUITestArtifactsTemplate.swift Extraction scripts (canonical): scripts/ui/xcresult_export.sh, scripts/ui/xcresult_summary.sh
After each code change:
scripts/ui/ui_loop.sh).references/snapshot-testing.md)..xcresult as evidence + exported attachments/diagnostics.xcresulttool subcommands.See references/REFERENCE.md for deeper troubleshooting and patterns.
scripts/ui/ui_loop.shscripts/ui/xcresult_summary.sh, scripts/ui/xcresult_export.shscripts/ui/patch_xctestrun_attachment_policy.py, scripts/ui/patch_xcscheme_attachment_policy.py, scripts/ui/xcresult_sanitize_attachments.pyscripts/macos/tcc_attribution_tail.sh, scripts/macos/collect_tcc_identities.shscripts/project/update_ui_loop_tools.shscripts/ui/toolchain_fingerprint.shassets/templates/*.swiftreferences/REFERENCE.mdiOS simulator helpers:
scripts/ios/simctl_prepare.shscripts/ios/simctl_privacy.sh~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.