diff --git a/docs/continuation.md b/docs/continuation.md index 538b163..93d5fd5 100644 --- a/docs/continuation.md +++ b/docs/continuation.md @@ -24,6 +24,14 @@ certificate checks, redirect refusal, encryption and expiry are unchanged. Login errors now distinguish credential/code rejection from session-cookie problems and a successful retry clears the old error. Both secure/default-cookie test modes are in CI; see `login-troubleshooting.md` and the latest validation section. +The fix is source `4b483c2`; local 13 JVM, both 7-test cookie modes, 6 ordinary +native UI tests, lint and all packages pass. Gitea build job 1071/run 666 (#11) +passed and published the actual 0.2.1/code-3 APK; downloaded, verified and installed/ +launched on `emulator-5554`. Exact link/checksum are in `validation.md`. +That CI-signed debug APK is now installed on the local emulator. Its certificate +differs from the local Gradle debug key: before another local device-test run, +remove only this synthetic preview package or use a fresh AVD. An install failure +with zero tests must not be reported as a passing instrumentation run. The owner-authorized signing key and four Gitea secrets were created before this correction. Their private backup is `/home/neste/yuvomi-signing/initial-20261021`. diff --git a/docs/login-troubleshooting.md b/docs/login-troubleshooting.md index 061b923..fbfb716 100644 --- a/docs/login-troubleshooting.md +++ b/docs/login-troubleshooting.md @@ -16,6 +16,11 @@ AndroidKeyStore encryption and absolute expiry remain unchanged. The native clie does not depend on weakening the server or changing its configuration. For browser security, server operators should still use `SESSION_SECURE=true` on HTTPS sites. +[Download the fixed 0.2.1 preview APK ZIP](https://git.nesterovic.cc/nessi/Yuvomi-App/actions/runs/666/artifacts/android-native-debug-apk) +(verified Gitea build job 1071; repository access required, 14-day retention). +Extract `app-debug.apk` and install it. The downloaded artifact's version and +signature were checked and installation/launch tested on the authorized emulator. + ## Error distinctions - Rejected username/password: the server rejected `/auth/login` with HTTP 401. diff --git a/docs/validation.md b/docs/validation.md index 5bfa961..97cea1e 100644 --- a/docs/validation.md +++ b/docs/validation.md @@ -27,8 +27,21 @@ and session-only cookie persistence remain disallowed. error, native dashboard/recreation, task/note/shopping calls and logout. - 13 JVM tests passed, including default-cookie persistence/deletion, expired/empty session detection and separate credential/2FA/session-handoff error messages. +- Both lint variants, debug/unsigned release APK/AAB builds and the 6-test ordinary + native UI suite passed. Its first attempt hit a leftover CI-debug certificate + mismatch and produced zero tests; the verifier correctly rejected it. After + confirming the fixture package was absent, the rerun executed all 6 with no + failures/skips (`/home/neste/yuvomi-login-debug-retry.log`). - Logs: `/home/neste/yuvomi-login-cookie-after.log`, - `/home/neste/yuvomi-login-secure-after.log`, `/home/neste/yuvomi-login-unit.log`. + `/home/neste/yuvomi-login-secure-after.log`, `/home/neste/yuvomi-login-unit.log`, + `/home/neste/yuvomi-login-validation.log`. +- Gitea run #11/global 666, build job 1071 at `4b483c2`: packages, JVM/lint, + repository/script/format checks, OSV and artifact uploads all succeeded. +- [Download fixed Android 0.2.1/code 3](https://git.nesterovic.cc/nessi/Yuvomi-App/actions/runs/666/artifacts/android-native-debug-apk). + The ZIP was downloaded and its sole APK version/v2 signature checked; it was + installed and launched on the authorized local emulator. APK SHA-256: + `a769118f0bd16988f76a8ee95c0aa0c5e248104e8ea529eee2e0c83d78b6ca5a`. + This does not certify the still-blocked remote emulator matrix or Apple pipeline. See [login troubleshooting](login-troubleshooting.md). This reproduces a matching compatibility defect without accessing the user's server or credentials; it does