Carry Meta DAT credentials as build settings, not a personal plist copy

[straff2002]

The bug

The Meta DAT credentials reached the build through a gitignored whole-Info.plist copy (INFOPLIST_FILE → Config/Info/Info.personal.plist). That mechanism failed twice, in opposite directions:

• While it was on, the copy went stale. Keys added to OpenGlasses/Info.plist after the snapshot never reached archives — App Store validation failed with ITMS-90683 (missing NSLocationAlwaysAndWhenInUseUsageDescription).
• 71333ea fixed that by dropping the override — and silently took the credentials with it, since the personal plist was the only thing carrying them. MetaAppID fell back to the committed YOUR_META_APP_ID.

The second failure is near-invisible. A placeholder app ID doesn't error: it stalls DAT registration below state 3, and the camera permission prompt is gated behind that state. The symptom is a Connect button that appears to do nothing and a permission dialog that never fires. Existing installs kept working on their cached registration, so it only surfaced weeks later on the next first-time setup.

The fix

Substitute the values into the committed plist, the way TeamID already uses $(DEVELOPMENT_TEAM):

MetaAppID   = $(MWDAT_META_APP_ID)
ClientToken = AR|$(MWDAT_META_APP_ID)|$(MWDAT_CLIENT_TOKEN_HASH)

project.base.yml holds the placeholders (a clone still builds, and the launch-time check still recognises them); real values live only in gitignored project.local.yml. One source of truth for every other plist key, so staleness is structurally impossible — and there's no plist copy left to swallow secrets again.

Remaining footguns closed

• setup-local-dev.sh rewrites project.local.yml wholesale, which would have destroyed the credentials on the next run — the same regression relocated. It now reads existing values back and preserves them, reporting which path it took. Verified by round-tripping the real script.
• It no longer seeds a personal Info.plist, and the mechanism is deleted. Rebranding never needed it either: PRODUCT_BUNDLE_IDENTIFIER and INFOPLIST_KEY_CFBundleDisplayName are build settings.

Self-diagnosing failure

A silent placeholder is what cost the debugging time, so MWDATConfigCheck (pure, 9 tests) now distinguishes a placeholder from an unexpanded $(…) reference — different fixes — and names the fix rather than the fault. It runs at launch and, more usefully, pre-empts the connect-failure message: a bad build config and a missed Meta AI link-back produce an identical stalled state, and the old text sent the user chasing associated-domains for a problem they didn't have.

Verification

• Built plist carries the real credentials and all four previously dropped usage-description keys (the ITMS-90683 regression guard).
• A build with project.local.yml removed falls back to the placeholders, so contributors are unaffected.
• Full suite green: 2788 tests, 0 failures.
• No credential appears in any tracked file (the Meta App ID in index.html is pre-existing and public by design; the client token hash appears nowhere).

🤖 Generated with Claude Code