nessi/Yuvomi-App
SHA256
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: record verified native preview and unfinished PWA parity
Android validation / emulator (35) (push) Failing after 4s
Details
Android validation / emulator (37.0) (push) Failing after 6s
Details
Android validation / build (push) Successful in 5m27s
Details
iOS validation / simulator (push) Canceled after 23m26s
Details

Browse Source 
Replace current wrapper claims with native architecture/security/build evidence, preserve historical documents, track all thirty pages and explicit release gates, correct brand attribution and provide the twelve-section delivery report without claiming completion. Native signing remains paused and Apple application/device validation outstanding.
This commit is contained in:
Yuvomi Mobile Contributors committed 2026-10-21 09:13:36 +02:00
1 parent 1433e1670a
commit 40a7962307
20 files changed
+813 -277
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/legacy-wrapper-architecture.md
+41
View File
@@ -0,0 +1,41 @@
# Historical architecture — superseded WebView prototype
Two independent native applications share a policy, not a cross-platform runtime:
| Responsibility | Android | iOS |
| --- | --- | --- |
| Native entry/configuration | ComponentActivity and platform widgets | SwiftUI |
| Web application | Android WebView | WKWebView |
| Server URL policy | ServerAddress | ServerAddress |
| Reachability/metadata | HttpsURLConnection, no redirects/cookies | Ephemeral URLSession, no redirects/cookies |
| Authentication | Upstream web UI and OS cookie jar | Upstream web UI and WKWebsiteDataStore |
| OIDC | Separate restricted web view after consent | Separate restricted web view after consent |
| Downloads | Origin-bound streaming / bounded blob capture and pull | WKDownload to temporary protected file, system export |
The client never reimplements a Yuvomi module or introduces a backend. The user
selects the origin. Bootstrap calls check the actual upstream unauthenticated
metadata contract before loading the server application. Configuration stores only
the origin and a query/fragment-free last path; auth/reset/invite routes are not
restored. No native password or API-token storage exists.
The current web view remains alive across background/resume and ordinary rotation.
Android handles orientation changes in the existing activity; process recreation
loads the remembered path and retains OS cookies, not unsaved web form memory.
iOS retains a StateObject-owned view; cold launch restores path and persistent
cookies. No resume reload is imposed. Native recovery offers Retry, Keep viewing,
and server management without hiding the route back to configuration.
Server erasure destroys the browsing context and clears all website storage before
another server is loaded. The local wipe does not invalidate the remote session;
logout is still a server-side operation. Web application history remains native
web history. External schemes, universal links and app links are not registered
because arbitrary self-hosted domains cannot be verified by this app in advance.
The optional integration build has a different Android package ID and adds trust
for a fresh test CA generated outside the repository. It uses the same production
code and the unmodified pinned upstream server. Neither normal debug nor release
resources include that CA. Never distribute an integration APK.
Read-only offline functionality belongs to upstream's service worker. The app
preserves it where the platform engine supports it, but does not promise offline
editing, synchronization, or the same PWA cache behavior on all OS versions.