chore(repo): establish isolated mobile repository and upstream audit

.gitattributes

@@ -0,0 +1,3 @@
+* text=auto eol=lf
+*.png binary
+*.jar binary

.gitignore

@@ -0,0 +1,20 @@
+.DS_Store
+.idea/
+.gradle/
+**/build/
+local.properties
+*.keystore
+*.jks
+*.p12
+*.mobileprovision
+.env
+.env.*
+DerivedData/
+*.xcuserstate
+xcuserdata/
+ios/Yuvomi.xcodeproj/
+.swiftpm/
+.build/
+artifacts/
+__pycache__/
+node_modules/

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Yuvomi Mobile contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,24 @@
+# Yuvomi Mobile
+
+Independent, community-maintained Android (Kotlin/WebView) and iOS
+(SwiftUI/WKWebView) companions for user-owned [Yuvomi](https://github.com/ulsklyc/yuvomi)
+servers. Not affiliated with or endorsed by upstream.
+
+**Development build - not production-ready.** See [validation status](docs/validation.md).
+No mobile backend, advertisements, telemetry, tracking, subscriptions, or mandatory cloud.
+The configured server supplies the application and retains responsibility for its own
+integrations, version checks, security and privacy.
+
+Use a root-hosted HTTPS instance with a valid certificate, including private servers
+accessible through your VPN. Custom ports are supported. HTTP and subpath deployments
+are intentionally rejected. Enter the server on first launch; use Server settings to
+reconnect or erase local browsing data and switch installations.
+
+- [Architecture](docs/architecture.md)
+- [Android build](docs/build-android.md) / [iOS build](docs/build-ios.md)
+- [Compatibility and authentication](docs/server-compatibility.md)
+- [Release process](docs/release-process.md)
+
+MIT licensed. Upstream notices are preserved in `THIRD_PARTY_NOTICES.md`.
+This implementation is AI-assisted (OpenAI via OpenCode) and requires human security
+review before release. No upstream modification or public submission is authorized.

THIRD_PARTY_NOTICES.md

@@ -0,0 +1,33 @@
+# Attribution
+
+Yuvomi Mobile is an independent community contribution, not an official Yuvomi
+product. Yuvomi's name identifies the server with which it interoperates.
+Visual color values follow upstream DESIGN.md. No upstream logo is redistributed.
+
+Upstream Yuvomi: https://github.com/ulsklyc/yuvomi
+
+MIT License
+
+Copyright (c) 2026 ulsklyc
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+Android build dependencies retain their own licenses (Android SDK/platform APIs,
+AndroidX: Apache-2.0; Kotlin: Apache-2.0; Gradle: Apache-2.0).
+Apple system frameworks are provided by the operating system, not vendored here.

docs/upstream-audit.md

@@ -0,0 +1,35 @@
+# Upstream source audit
+
+Inspected 2026-10-20: https://github.com/ulsklyc/yuvomi
+revision `10bfef7686ed7303b4c74c7fcc55a5eb16356c9d`, package version `2.78.0`.
+Source was cloned outside this repository; no upstream files were modified.
+
+Read README, CONTRIBUTING (including AI disclosure), SECURITY, DESIGN, package
+manifest, server/index.js, server/auth.js, public/sw.js, sw-register.js and
+notification settings. Reviewed the latest 100 open issues/PRs via GitHub API;
+that sample is not an exhaustive review of all historical reports.
+
+Findings:
+
+- Frontend has no framework/build step; native projects remain separate.
+- Public `/api/v1/version` exposes `app_name`, `setup_required`,
+  `password_reset_enabled`, **not** a release number before authentication.
+- `/api/v1/auth/oidc/config` exposes enabled/password-login flags.
+- Sessions are HttpOnly, SameSite=Lax, persistent cookies. Operators must set
+  `SESSION_SECURE=true` behind TLS. Native code must not replace auth or CSRF.
+- Username/password, TOTP/recovery codes, reset and logout are web features.
+- OIDC stores state, nonce and PKCE in the initiating browser's server session,
+  and returns to the configured server callback. There is no mobile callback,
+  one-time session exchange, or universal-link association protocol.
+- Root-relative API, assets, redirects, service-worker registration and cookie
+  path mean subpaths cannot be promised. Use a dedicated hostname instead.
+- Service worker has versioned shell caches and allow-listed read-only API
+  caching; mutations and authentication remain network-only. No offline editing.
+- Web Push is not native push. Optional upstream ntfy/Gotify/webhook channels
+  provide self-hosted alternatives through their own clients.
+- Upstream uses violet `#6C3AED`, warm grouped background `#F5F3ED`, and native
+  system fonts. Native screens follow these tokens without changing web design.
+
+Compatibility probing is structural, not cryptographic identification: any server
+can imitate the public endpoints. Users must trust the URL they enter. Exact release
+compatibility needs authenticated integration testing; no version range is inferred.