Codex + SwiftUI: Getting an Agent-Built iOS App Approved

Codex writes good SwiftUI. Declarative views, view models and async networking are exactly the kind of well-documented patterns language models handle well. App Review, however, looks at things the agent rarely sees: what the app asks permission for, how it describes data use, whether every button leads somewhere. This guide focuses on the gap between "it compiles" and "it is approved".

Why agent-built SwiftUI apps get rejected

Apple does not care whether code was written by a person or an agent. Rejections of agent-built apps cluster around the same guidelines as everyone else's, but some mistakes are much more common when nobody looked closely at the project configuration.

For the full list of common rejections across all app types, see the most common App Store rejection reasons.

Lock the project settings the agent should not touch

Agents edit whatever helps the build succeed. In an Xcode project, that can include settings with real consequences. Add explicit rules to your AGENTS.md and review any diff that touches these:

• Bundle identifier and team: changing them breaks signing and can create a different app record.
• Signing style and provisioning profiles: keep these under human or CI control.
• Entitlements: push notifications, iCloud, associated domains and App Groups must match capabilities enabled in your developer account.
• Info.plist usage descriptions: every protected resource you access needs a clear, honest purpose string.
• Deployment target: an agent may raise it to use a newer SwiftUI API, silently dropping users on older iOS versions.
• Version and build numbers: let your pipeline increment build numbers, not the agent.

Background on certificates, profiles and keys is in iOS code signing explained.

The privacy manifest and third-party SDKs

Since 2024, Apple expects a privacy manifest (PrivacyInfo.xcprivacy) declaring the data your app collects and the reasons for using certain system APIs, such as UserDefaults or file timestamps. Many commonly used third-party SDKs must ship their own manifest as well. Agents frequently add packages through Swift Package Manager without thinking about this.

1. List every package in Package.resolved and confirm each one is needed.
2. Check that your app's privacy manifest declares the required-reason APIs your own code uses.
3. Generate a privacy report from the archive in Xcode and compare it with your App Store privacy details.
4. Remove analytics or crash SDKs the agent added "for completeness" if nobody decided to use them.

Build verification Codex cannot do in the cloud

The Codex cloud agent runs in Linux containers, so it cannot run Xcode, the simulator or xcodebuild. That means code it writes in the cloud has never been compiled for iOS until you pull it. A workable routine:

1. Let the cloud agent open pull requests for well-scoped changes.
2. Run a macOS CI job (or the Codex CLI on a Mac) that builds and runs unit and UI tests on every pull request.
3. Install the build on at least two physical devices with different screen sizes before each release, including with large Dynamic Type and dark mode.
4. Distribute through TestFlight to a handful of external testers; their feedback catches flows the agent never exercised.

Pre-submission routine

• Archive with the Release configuration and confirm no debug menus or test endpoints are reachable.
• Walk through every screen from a fresh install, logged out and logged in.
• Deny every permission once and confirm the app still behaves sensibly.
• Prepare a demo account and short review notes explaining non-obvious features.
• Fill in App Privacy details to match the privacy manifest and the actual network traffic.
• Check that screenshots show the current build.

When review comes back negative

Read which guideline is cited and respond specifically. If the reviewer misunderstood a feature, a short explanation with steps to reproduce often resolves it. If the finding is valid, fix it, increment the build number and resubmit with a note describing the change. Avoid arguing about other apps that do the same thing; it does not help.

If you would rather not manage certificates, pipelines and review back-and-forth yourself, appsubmitter.io combines AI assistance with human experts to set up CI/CD, sign and submit builds in your own Apple developer account and guide you through rejections. The broader workflow, including the parts before SwiftUI, is covered in From ChatGPT Codex to the App Store, and the Claude Code counterpart is building an iOS app with Claude Code.