cloudkit-schema-source-of-truthlisted

# CloudKit Schema Source of Truth CloudKit has no migration-file system like a SQL database. The schema lives in Apple's CloudKit Dashboard/Console, and `xcrun cktool` (Apple's official CLI, ships with Xcode) can export, validate, and import it — but only against the **Development** environment. Production promotion is a manual, irreversible Console action. This skill makes the Development side of that workflow scriptable and commit-trackable while keeping the Production gate correctly user-owned. ## When to invoke - A persistence change adds, renames, or edits a CloudKit record type, field, or index. - You need to push schema to a container (Development or Production). - Before any Production schema deploy — read the safety gate below first. - Asked why a `.ckdb` file is committed to the repo, or why a field the app writes is missing from Production data. ## Scope Owns: the `.ckdb`-as-source-of-truth workflow, `cktool` invocations against Development, and the Production promotion gate. Does **not** own: the Swift-side persistence/service code that reads and writes CloudKit records → `swift-dependency-injection` for how that seam is injected and faked in tests; secret storage for the management token itself → `apple-public-repo-security` / `build-time-secret-injection`. ## Prerequisites (one-time, user-owned) Two credentials, kept in a gitignored env file (e.g. `secrets/.env`, with a committed `.env.example` template): - **A CloudKit management token** — generated b