ClearToGo

Before you erase your old iPhone, ClearToGo finds the app access and data risks your new iPhone may still be hiding.

Comment

Inspiration

An iPhone transfer can look complete while the old phone is still the only place where a bank login, authenticator, work account, passkey, message history, or locally stored file actually works. The dangerous moment comes later, when the old iPhone is erased, sold, traded in, or returned and the missing access is discovered too late.

ClearToGo is a macOS app for that final checkpoint. It helps a person compare the old and new iPhones, decide which apps matter, perform the smallest useful set of real checks on the new phone, and understand what still needs recovery. It never erases a device and never claims that erasure is safe.

What it does

The user connects both iPhones and explicitly assigns the old and new roles. ClearToGo reads each installed-app inventory through a read-only Standard Scan that does not require Developer Mode. It uses deterministic guardrails and GPT-5.6 to narrow the source inventory to likely priorities while keeping the complete list searchable, so the user can recover anything AI missed.

The user makes each importance decision before seeing the AI rationale. GPT-5.6 then converts the confirmed apps and iPhone features into a subject-bound risk ledger and a minimum set of plain-language checks: sign in, approve authentication, receive a message, open a recent photo, or verify an important local item. Private actions stay on the iPhone; ClearToGo records only the outcome and its provenance.

Deterministic code—not the model—validates completeness, evidence compatibility, severity, and the final state. The only states are BLOCKED, CHECKS_COMPLETED_WITH_USER_CONFIRMATION, and CHECKS_PASSED. The product never exposes an erase action or says the old phone is safe to erase.

How we built it

ClearToGo is a native macOS SwiftUI application. Its device bridge uses a read-only libimobiledevice inventory path, keeps physical-device handles ephemeral, and never sends device names or product types to GPT. File-backed checkpoints and audit events support recovery without persisting USB identity.

GPT-5.6 runs through managed ChatGPT OAuth and a local Codex runtime. Every inference uses an ephemeral thread, strict structured output, an isolated working directory and CODEX_HOME, no executable tools, and no API-key fallback. Returned subjects and required risks must match the exact outbound session inventory. Invalid, incomplete, mutated, or uncovered output fails closed.

The interface follows a provenance-first Continuity Atlas system. Live, Replay, Simulator, development-synthetic, and user-confirmed evidence remain structurally distinct. English is the production language; Korean localization is retained for development and accessibility review.

How Codex was used

Codex was part of the entire build, not an after-the-fact assistant. It helped turn a safety-focused product contract into Swift modules and requirement-linked tests; implement and harden the read-only device bridge; build strict GPT-5.6 and OAuth boundaries; generate adversarial validators; create the SwiftUI experience; diagnose real-device, restoration, structured-output, and timeout failures; and keep the README, acceptance evidence, and submission materials synchronized.

The builder retained the consequential decisions: a Mac-first product, read-only scanning without Developer Mode, explicit old/new role selection, human judgment before AI rationale, full-inventory recovery, GPT-5.6 for semantic reasoning, deterministic code for final state, no erase control, and honest evidence provenance.

Challenges we ran into

Real devices revealed problems that fixtures did not. Large inventories initially created too much manual review. Restored sessions could not reuse ephemeral USB handles. A valid-looking model plan failed strict subject/risk coverage. Internal schema vocabulary leaked into consumer guidance. A 90-second inference budget inherited from an earlier API assumption was too short for a larger plan.

We addressed those issues with audited batching, conservative candidate recovery, explicit role re-selection and inventory matching, typed non-payload diagnostics, retry without rescanning, consumer-safe fallback guidance, and a measured 240-second per-attempt engineering budget.

The historical two-iPhone run exposed two concrete product defects: an independent four-app check shared one result, and generic email/VPN names were interpreted as work access without explicit company context. The current revision deterministically splits independent multi-app checks into app-scoped checks, preserves genuinely inseparable cross-app actions, and neutralizes unsupported work-purpose inference. Automated mixed-outcome regressions pass. A separate corrected Live run completed 17 actions covering 18 risks without either defect recurring; the historical run remains a distinct BLOCKED record and is not reinterpreted.

Accomplishments that we're proud of

  • A historical normal-product run compared 117 apps on the old iPhone with 98 on the new iPhone and exposed the grouped-outcome and unsupported account-purpose defects. Its distinct packet remains BLOCKED and is not rewritten as post-fix evidence.
  • A separate corrected Live run narrowed 117 source apps to 37 suggestions and 11 required apps, read 98 destination apps, generated 17 actions covering 18 risks, and reached CHECKS_COMPLETED_WITH_USER_CONFIRMATION with 18 user-confirmed results, 0 recovery results, and 0 unchecked results. The two historical defects did not recur.
  • The default automated suite contains 420 tests: 412 pass, 0 fail, and 8 explicit opt-in tests are skipped by default.
  • A failure-inclusive current-model benchmark retains three preregistered holdout failures and then passes a new zero-overlap 24-app KR public holdout in three frozen gpt-5.6-sol runs, each with TP 12, FP 0, FN 0, TN 12. The claim is limited to execution and repeatability on that holdout.
  • The Release build contains no development-hybrid activation, fake identifiers, or demo provenance markers.
  • A credential-free, Debug-only Judge Demo runs in under five minutes without an iPhone, ChatGPT login, API key, or network model call, while remaining permanently labeled as synthetic Replay evidence.
  • More than 50 repository commits were created during the submission period, with no pre-period commit in this repository.

What we learned

Installed does not mean working. A migration checker must distinguish inventory clues from account access, authentication, data visibility, and user confirmation. AI is useful for interpreting app meaning and minimizing the action plan, but safety improves when deterministic code owns completeness and final state. Provenance is not just an audit field; it has to be visible in the product language and interaction design.

What's next

Future product work can extend physical VoiceOver across initial role/consent, active scan/planning retry, and Challenge outcomes; broaden the public holdout with a consented private human-labeled evaluation; and prepare signing, notarization, sandboxing, runtime packaging, and consumer distribution. None of those optional evidence or distribution modalities is an automatic current shortlist requirement. The complete physical Keyboard Navigation route, final-packet VoiceOver, and a partial completed-screen VoiceOver revisit are already proven; the corrected two-physical-iPhone Live rerun is complete with user-confirmed provenance.

Built With

  • chatgpt
  • chatgpt-oauth
  • codex
  • github-actions
  • gpt-5.6
  • libimobiledevice
  • libplist
  • macos
  • openai
  • privacy
  • security
  • structured-outputs
  • swift
  • swiftui
  • xcode-16
  • xcodegen
  • xctest
Share this project:

Updates