docs: record verified development delivery and explicit release gates

Document independent native architecture, server compatibility, build/signing procedures, privacy limitations and persistent continuation steps. Record two consecutive seven-test API 35 HTTPS/OIDC passes, portable and host-tool checks, and inspected unsigned artifacts. Explicitly withhold production readiness pending Apple SDK validation, API 37/current-device testing, real IdPs, resource-limit review, human security review and maintainer signing.
2026-10-21 07:32:50 +02:00
1 parent 9ca11e4fb5
commit 2d12491516
@@ -0,0 +1,77 @@
+# Maintainer continuation
+
+This is a development delivery, not authorization to publish. Preserve the Git
+history on `feat/yuvomi-mobile`; use Conventional Commits and normal pushes only.
+The authorized community remote is `https://git.nesterovic.cc/nessi/Yuvomi-App`.
+Do not push, submit issues or open pull requests against upstream on this task's
+behalf. No production credentials or store accounts have been provided.
+
+## Start with the evidence
+
+Read [validation](validation.md), [security review](security-review.md), and
+[release gates](release-process.md). Do not repeat completed implementation work
+or equate portable Swift checks with an iOS app build. Inspect `git status` before
+editing; preserve any newer maintainer changes.
+
+The upstream reference is Yuvomi 2.78.0 at
+`10bfef7686ed7303b4c74c7fcc55a5eb16356c9d`. Keep it unmodified. Subpath hosting,
+browser-to-native OIDC handoff and native remote push are not implemented.
+
+The extended API 35 HTTPS suite passes all seven tests, including the local-IdP
+round trip, native transfers, recovery and back navigation. Portable Swift has
+seven passing policy tests; the separate JUnit verifier has eight regressions.
+Keep the fixture's scope separate from real-provider or Apple-platform validation.
+
+## Persistent local environment (Linux/WSL)
+
+- Repository: `/mnt/c/Users/neste/Documents/GIT/Yuvomi-App`.
+- Upstream and installed dependencies: `/home/neste/yuvomi-tools/upstream`.
+- SDK: `/home/neste/yuvomi-tools/android-toolchain/android-sdk`.
+- Build outputs/logs: `/home/neste/yuvomi-build`.
+- Swift 6.2.1: `/home/neste/yuvomi-tools/swift-6.2.1-RELEASE-ubuntu24.04/usr/bin`.
+- Swift compatibility libraries: `/home/neste/yuvomi-tools/compat/usr/lib/x86_64-linux-gnu`.
+- Swift scratch output: `/home/neste/yuvomi-swift-build`.
+- ktlint and actionlint: `/home/neste/yuvomi-tools/ktlint.jar` and
+  `/home/neste/yuvomi-tools/actionlint`.
+- Local collected artifacts/evidence: ignored `artifacts/android/`.
+
+`/tmp/opencode` is temporary and was cleared by server restarts. Background
+processes may also disappear. Keep durable logs under `/home/neste`; never persist
+the integration fixture's generated private CA, keys or real household data.
+
+```sh
+export ANDROID_HOME=/home/neste/yuvomi-tools/android-toolchain/android-sdk
+export YUVOMI_BUILD_DIR=/home/neste/yuvomi-build
+"$ANDROID_HOME/platform-tools/adb" devices -l
+"$ANDROID_HOME/platform-tools/adb" shell am get-started-user-state 0
+# Require RUNNING_UNLOCKED, then:
+python3 scripts/test-integration.py /home/neste/yuvomi-tools/upstream --android
+bash android/gradlew -p android testDebugUnitTest lintDebug lintRelease assembleDebug assembleRelease bundleRelease
+python3 scripts/collect-android-artifacts.py
+```
+
+The API 35 AVD is `yuvomi-test`. Its stable attempt uses KVM, `-gpu host`,
+`-no-window -no-audio -no-boot-anim -no-snapshot -memory 2560 -cores 2`.
+Launch under the SDK/AVD owner with access to the `kvm` group. Other GPU modes
+previously crashed the host emulator with SIGSEGV. API 37 had broken services and
+locked credential-encrypted storage; no API 37 runtime success is claimed.
+
+For portable Swift checks add the compiler directory to `PATH` and set
+`LD_LIBRARY_PATH` to the compatibility-library directory above, then use the
+commands in [iOS development](build-ios.md). Apple application/XCTest/UI/archive
+validation must happen on macOS with Xcode and real supported devices.
+
+## Highest-priority external work
+
+1. Typecheck/build the iOS app against Apple SDKs, run its actual XCTest/UI tests,
+   and produce an unsigned archive. Fix any failures; none of these ran locally.
+2. Run the API 37 permission grant/denial/revocation scenarios on a working image
+   or device, plus the minimum-supported Android and current WebView matrix.
+3. Review iOS unknown-length download disk-pressure handling before release.
+4. Validate real supported IdPs, TOTP after SSO, linking, cancellation, native
+   file/camera pickers, process death, accessibility and offline account isolation.
+5. Establish private vulnerability reporting, owned identifiers, authorized CI,
+   human security review and owner-controlled signing before any distribution.
+
+The provided GitHub Actions workflows do not automatically execute on the current
+non-GitHub forge. Do not claim hosted CI or store readiness without actual runs.