# Apple Platform Frontier for Mac Utilities > Source-anchored research for Apple Platform Frontier for Mac Utilities. Run status: COMPLETED. Parent: [Apple Platform Publishing (Mac App Store)](https://llms-explorer.com/tree/apple-platform-publishing-mac-app-store/) · 6 facets · 45 facts · page: https://llms-explorer.com/tree/apple-platform-frontier-for-mac-utilities/ ## Definitions - asc (rorkai/App-Store-Connect-CLI) is an MIT-licensed, unofficial Go CLI: asc validate, submit, asc review status/doctor, asc status --watch; authenticates with key-id, issuer-id and private key, with --bypass-keychain for headless CI. It states it is not affiliated with Apple. (low confidence) (verified as of 2026-10-02) — [source](https://github.com/rorkai/App-Store-Connect-CLI) ## How it works - Review submission via API is a three-step flow: POST /v1/reviewSubmissions (app + platform), POST /v1/reviewSubmissionItems linking the app version, then PATCH the submission with submitted=true. Order matters; out-of-order calls give 422/foreign-key errors. (medium confidence) — [source](https://dev.to/snake_sun/the-asc-apis-3-step-review-submission-flow-and-why-appstoreversionsubmissions-is-gone-24ld) - Availability is not guaranteed: SystemLanguageModel.default.availability returns .available or .unavailable with reasons deviceNotEligible, appleIntelligenceNotEnabled or modelNotReady, and Apple tells developers to check it before creating a LanguageModelSession and show a fallback. A Mac App Store diagnosis feature must therefore degrade to non-AI output on ineligible Macs or when the user has Apple Intelligence off. (high confidence) — [source](https://developer.apple.com/events/resources/code-along-205/) - WWDC26 introduces a LanguageModel protocol so session code is unchanged when swapping the Apple model for a third-party one (Anthropic and Google publish Swift packages; open-source CoreAILanguageModel and MLXLanguageModel run local models). A monitor can develop against SystemLanguageModel and make cloud a user-chosen option. (medium confidence) (verified as of 2026-06-08) — [source](https://developer.apple.com/videos/play/wwdc2026/241/) - When mDNSResponder gets DoH/DoT designated-resolver info for the current network, it upgrades automatically and the traffic bypasses an active NEDNSProxyProvider; the proxy never sees those queries. Fleet cites Apple feedback FB11963304 as confirming this is intended. DoH on port 443 is indistinguishable from normal HTTPS, so a monitor may report zero DNS activity. (medium confidence) (verified as of 2026-08-15) — [source](https://fleetdm.com/guides/monitor-dns-traffic-on-macos) ## Measurements and reference values - Apple's own evaluation shows the on-device model beating Qwen-2.5-3B across languages and competitive with Qwen-3-4B and Gemma-3-4B in English, with a ~4.6% MGSM regression from compression; quality is mid-size-open-model level, below cloud frontier models for reasoning over large contexts. (medium confidence) — [source](https://machinelearning.apple.com/research/apple-foundation-models-2025-updates) ## Problems, failure modes and limitations - API keys come in two types: Team keys (all apps, role-based, created by an Admin) and Individual keys (inherit one user's apps and roles). Individual keys cannot use Provisioning endpoints, Sales and Finance, or notaryTool. The private .p8 downloads once only; never commit it. (high confidence) — [source](https://developer.apple.com/documentation/appstoreconnectapi/creating-api-keys-for-app-store-connect-api.md) - fastlane recommends a Team key (required for provisioning-related API access); credentials are key_id, issuer_id and the .p8 content, JWT duration max 1200 seconds. fastlane produce has only partial API-key support, pem is Apple ID only, precheck cannot check IAPs with API keys. (medium confidence) (verified as of 2026-10-02) — [source](https://docs.fastlane.tools/app-store-connect-api/) - Apple rejects JWTs with lifetime over 20 minutes for most requests; responses carry an X-Rate-Limit header with an hourly rolling limit, so throttle polling and back off. (medium confidence) — [source](https://launchbuddy.app/blog/app-store-connect-api/) - A Private app cannot be changed to Public (and Public cannot become Private); changing requires a new app record. Public can later become Unlisted after approval via an Apple request. (high confidence) — [source](https://developer.apple.com/help/app-store-connect/manage-your-apps-availability/set-distribution-methods) - An independent arXiv audit (24 Aug 2026) of SystemLanguageModel.default found it confabulated confidently on 69.1% of false-premise questions, refused 18.4% of benign summarization inputs (peers 0%), and had verbalized confidence near 99% with chance-level AUROC 0.47. A diagnosis feature should not present model output as authoritative; ground it in measured data and let deterministic code decide pass/fail. (low confidence) (verified as of 2026-08-24) — [source](https://arxiv.org/html/2608.23663v1) - Enforcement timeline for the platforms that are covered: warning emails from 2024-03-13, App Store Connect rejection of missing declarations from 2024-05-01 (ITMS-91053). Invalid manifests (unexpected keys or values) are rejected on any platform, with an email naming the bad file path. (high confidence) (verified as of 2026-10-02) — [source](https://developer.apple.com/documentation/bundleresources/describing-use-of-required-reason-api) - If NSPrivacyTracking is true, domains in NSPrivacyTrackingDomains fail with an error when the user has not granted ATT permission. A DNS/network monitor that surfaces tracker domains is not itself tracking, so it should set NSPrivacyTracking false unless it really tracks. (medium confidence) — [source](https://developer.apple.com/documentation/bundleresources/privacy-manifest-files) ## Comparisons and alternatives - WWDC26 adds PrivateCloudComputeLanguageModel behind the same session API: 32,000-token context, reasoning levels (.light/.deep), no account or API key, prompts not stored, free for developers under 2 million first-time downloads with higher daily limits for iCloud+ users. It is a cloud call, so it needs the network and its privacy claim is Apple's PCC guarantee rather than on-device. (medium confidence) (verified as of 2026-06-08) — [source](https://developer.apple.com/videos/play/wwdc2026/241/) ## Facts and statements - The older single-call /appStoreVersionSubmissions endpoint is described as gone/replaced by reviewSubmissions; Apple's own deprecation notice was not retrievable, so confirm against the OpenAPI spec. (low confidence) (verified as of 2026-10-02) — [source](https://dev.to/snake_sun/the-asc-apis-3-step-review-submission-flow-and-why-appstoreversionsubmissions-is-gone-24ld) - Search reports state no API exists for the App Privacy questionnaire (manual in the web UI) while age ratings are automatable via ageRatingDeclarations; treat as unverified against Apple docs. (low confidence) (verified as of 2026-10-02) — [source](https://launchbuddy.app/blog/app-store-connect-api/) - Apple's release feed lists App Store Connect API 4.5 (22 Sep 2026) as latest; 4.3.1 shipped 12 May 2026. Individual API keys reportedly landed May 2026 per search summary of a Fivetran changelog, not Apple. (low confidence) (verified as of 2026-09-22) — [source](https://developer.apple.com/news/releases/?id=05122026a) - Private distribution (Custom Apps) is chosen in App Store Connect under Pricing and Availability > App Distribution Methods > Private, restricted to specified Organization IDs (or Apple Accounts for legacy VPP). Distribution is via MDM or redemption codes. (high confidence) — [source](https://developer.apple.com/help/app-store-connect/manage-your-apps-availability/set-distribution-methods) - Custom apps go through standard App Review (typically 1-2 days); apps needing login must supply sample data/authentication to reviewers. Customer organizations must enable Custom Apps in settings, then find the app under Custom Apps in Apps and Books. (high confidence) — [source](https://support.apple.com/en-euro/guide/business/axm58ba3112a/web) - Customer admins find their Organization ID in Apple Business/School Manager under Preferences > Enrollment Information; the developer must collect it to target them. (medium confidence) — [source](https://developer.apple.com/support/volume-purchase-and-custom-apps/) - Apple announced Apple Business on 2026-03-24 and launched it 2026-04-14, merging Business Manager, Business Essentials and Business Connect into one free platform with built-in MDM in 200+ countries; Apple's own custom-apps guide is now titled 'Apple Business'. (high confidence) (verified as of 2026-04-14) — [source](https://www.macrumors.com/2026/04/14/apple-business-platform-launches/) - Third-party MDMs (e.g. Intune) sync custom apps through location tokens (legacy VPP tokens), valid one year; a token works with one MDM at a time; device licensing (default for new Intune assignments) installs via MDM only without App Store sign-in; user licensing covers up to 5 devices per Apple Account. (high confidence) (verified as of 2026-09-28) — [source](https://learn.microsoft.com/en-us/intune/app-management/deployment/manage-vpp-apple) - On macOS, revoking a VPP license leaves the app usable but un-updatable; Apple removes it after a 30-day grace period. Reusing a token on another MDM can lose license assignment records. (medium confidence) (verified as of 2026-09-28) — [source](https://learn.microsoft.com/en-us/intune/app-management/deployment/manage-vpp-apple) - Intune VPP tokens can use DDM management (iOS/iPadOS 18+) but DDM supports only Required/Uninstall, not Available; keep MDM for Available assignments and app-config policies. (low confidence) (verified as of 2026-09-28) — [source](https://learn.microsoft.com/en-us/intune/app-management/deployment/manage-vpp-apple) - A developer forum report shows a custom app assigned by device license failing on macOS InstallApplication with AMSErrorDomain code 301 'Invalid Status Code'; filed as FB11292074, no documented resolution (2022-era, example used iOS ID). (low confidence) — [source](https://developer.apple.com/forums/thread/712479) - The Foundation Models framework exposes Apple's roughly 3-billion-parameter on-device model to apps through a Swift API; it runs offline and Apple states it is designed for summarization, entity extraction, text understanding, refinement and short dialog, not as a general world-knowledge chatbot. (high confidence) — [source](https://machinelearning.apple.com/research/apple-foundation-models-2025-updates) - The WWDC26 release ships a rebuilt on-device model, better at logic and tool calling and with vision input; the session example prints model.contextSize as 8192 and adds model.tokenCount(for:) so an app can budget instructions and prompts. (medium confidence) (verified as of 2026-06-08) — [source](https://developer.apple.com/videos/play/wwdc2026/241/) - The original (2025) on-device model had a fixed 4096-token context window shared by instructions, prompt, tool schemas and response; exceeding it throws GenerationError.exceededContextWindowSize. A raw DNS or connection log therefore has to be pre-aggregated in app code before it reaches the model. (medium confidence) (verified as of 2026-06-08) — [source](https://developer.apple.com/forums/thread/806542) - On-device inference keeps prompt and response data on the Mac, so hostnames, IPs and resolver config in a diagnosis prompt are not sent to a third party; this is the privacy advantage over a cloud AI call. Apple also states it does not train on users' private personal data or interactions. (high confidence) — [source](https://machinelearning.apple.com/research/apple-foundation-models-2025-updates) - WWDC26 adds an fm command-line tool (macOS 27), a Python SDK, an Evaluations framework to measure feature quality, and open-sources the framework; the Evaluations framework is the sanctioned way to test diagnosis prompt quality before shipping. (low confidence) (verified as of 2026-06-08) — [source](https://developer.apple.com/videos/play/wwdc2026/241/) - Since iOS 16 / macOS Ventura, devices automatically upgrade to encrypted DNS via Discovery of Designated Resolvers (DDR): on joining a network the device issues an SVCB query for _dns.resolver.arpa and, if answered, uses TLS or HTTPS. DDR applies to one network at a time and does not work if the resolver has a private IP address. (high confidence) — [source](https://developer.apple.com/videos/play/wwdc2022/10079/) - System-wide encrypted DNS can be configured manually with NEDNSSettingsManager in an app or a DNSSettings profile payload; individual apps can opt in with PrivacyContext on NWParameters. Client certificate auth via identityReference on NEDNSSettings is supported since iOS 16 / macOS Ventura. (high confidence) — [source](https://developer.apple.com/videos/play/wwdc2022/10079/) - macOS 27 adds a DNS settings declarative (DDM) configuration for DoH (RFC 8484 URI template) or DoT (hostname), with optional supplemental match domains, failover to system DNS, client certificates and on-demand rules. It does not require supervision but requires MDM with Device Enrollment or Automated Device Enrollment (not User Enrollment). (medium confidence) (verified as of 2026-10-02) — [source](https://support.apple.com/guide/deployment/dns-settings-declarative-configuration-dep7e19a4b12/web) - At WWDC26 Apple moved network configurations, including DNS Proxy and DNS Settings, to declarative device management for OS 27, with public release expected fall 2026. (medium confidence) (verified as of 2026-06-11) — [source](https://www.jamf.com/blog/wwdc26-key-takeaways-for-apple-admins/) - On macOS 26.6.1, a network advertising DoT/DoH via DHCP DNR/DDR (RFC 9463/9462) made mDNSResponder send all queries, including local and split-DNS names, to the network's DoH resolver, overriding Tailscale DNS; scutil --dns still showed the configured servers, so 'dig works, apps don't'. (low confidence) (verified as of 2026-08-15) — [source](https://github.com/tailscale/tailscale/issues/20890) - After macOS 26.1 (reports from 2025-11-09), installing encrypted-DNS .mobileconfig files fails with 'The "VPN Service" payload could not be installed. The VPN service could not be created.' even though the profile has only a DNS Settings payload. (medium confidence) (verified as of 2025-11-10) — [source](https://github.com/mullvad/encrypted-dns-profiles/issues/18) - Mitigations for DNS visibility under encrypted DNS include using resolvers without DoH/DoT, answering _dns.resolver.arpa with NXDOMAIN, forcing a corporate encrypted resolver, firewalling known DoH IPs, SNI inspection, or a TLS-intercepting proxy; all are enterprise-side measures unavailable to a sandboxed App Store app. (low confidence) — [source](https://fleetdm.com/guides/monitor-dns-traffic-on-macos) - Apple's required-reason API documentation says to describe reasons for apps and SDKs 'on iOS, iPadOS, tvOS, visionOS, or watchOS'; macOS is not in that list. (high confidence) (verified as of 2026-10-02) — [source](https://developer.apple.com/documentation/bundleresources/describing-use-of-required-reason-api) - The privacy manifest page splits scope: collected-data-type declarations are required on all platforms; required-reasons API declarations only on iOS, iPadOS, tvOS, visionOS and watchOS. (high confidence) (verified as of 2026-10-02) — [source](https://developer.apple.com/documentation/bundleresources/privacy-manifest-files) - Independent developers reached the same reading: SwiftLee (2024-04-30): 'As of now, an API declaration is not required for macOS'; the .NET blog (2024-03-25) says macOS and Mac Catalyst do not seem to need required-reason entries; a 2026-09-05 project issue closed with macOS excluded from required-reason platforms. (medium confidence) (verified as of 2026-09-05) — [source](https://www.avanderlee.com/xcode/missing-api-declaration-required-reason-itms-91053/) - On macOS and Mac Catalyst the app manifest goes in Contents/Resources/PrivacyInfo.xcprivacy; macOS framework manifests go in Versions/A/Resources/. iOS-family apps use the bundle root. The file name PrivacyInfo.xcprivacy is mandatory. (high confidence) — [source](https://developer.apple.com/documentation/bundleresources/adding-a-privacy-manifest-to-your-app-or-third-party-sdk) - Required-reason categories: FileTimestamp (stat, fstat, lstat, getattrlist family; codes DDA9.1 display to user, C617.1 app container, 3B52.1 user-granted files, 0A2A.1 SDK wrapper), SystemBootTime (mach_absolute_time; 35F9.1, 8FFB.1, 3D61.1), DiskSpace (statfs/statvfs family; 85F4.1, E174.1, 7D9E.1, B728.1), plus UserDefaults and ActiveKeyboard. Each has off-device-transmission limits. (high confidence) (verified as of 2026-10-02) — [source](https://developer.apple.com/documentation/bundleresources/app-privacy-configuration/nsprivacyaccessedapitypes/nsprivacyaccessedapitype) - Apple says it reviews the required-reason API list and reasons continually and updates the article from time to time, so macOS scope could change; declaring accurate reasons anyway is low cost for a monitor that uses stat or mach_absolute_time. (low confidence) (verified as of 2026-10-02) — [source](https://developer.apple.com/documentation/bundleresources/describing-use-of-required-reason-api) - Apple's third-party SDK list (80+ SDKs, e.g. Firebase, Alamofire, Flutter, Realm) requires a privacy manifest plus a signature for binary dependencies, checked on App Store Connect submissions from 2025-02-12; a monitor app that bundles such SDKs must pick up versions that comply. (medium confidence) (verified as of 2026-10-02) — [source](https://developer.apple.com/support/third-party-SDK-requirements/) - Declared reasons bind behavior: data from these APIs may be used only for the declared reason, must match functionality shown to users, and may not be used for fingerprinting or tracking; most reasons forbid sending derived data off-device. (high confidence) — [source](https://developer.apple.com/documentation/bundleresources/describing-use-of-required-reason-api)