# Validation status **Partially verified development software, not production-ready.** Local validation date: 2026-10-21. No unexecuted iOS application test, hosted CI run, production signing, or store publication is represented as completed. ## Executed evidence - Android debug APK and unsigned release APK/AAB built successfully; both `lintDebug` and `lintRelease` passed. JVM security/picker-policy tests: **7 passed, zero failures/skips**. - Android API 35 regular emulator suite: **6 passed, zero failures/skips**. This covers onboarding, invalid URLs, background/resume, hardened settings, cross-origin POST/subresource isolation, opaque-page Blob rejection and activity recreation. Its permission test checks that the API 37 permission UI is absent; it is **not** evidence of API 37 permission grant/denial behavior. - Unmodified pinned upstream ran behind a temporary HTTPS reverse proxy. Bootstrap metadata, password login, Secure/HttpOnly/SameSite cookies, persistent session, CSRF rejection, logout/revocation passed in the harness. - Android's extended real-server scenario exercises login, HttpOnly cookies, document upload via upstream fetch, native FileTransfer output, bounded Blob export, background/resume, recreation, CSRF-protected logout, revocation, recovery, isolated OIDC return and back navigation. It does not automate the OS camera/document destination picker or prove every upstream module works. Two consecutive API 35 runs have **7 passed, zero failures/skips each**, including the six regular security/onboarding cases and this real-server scenario. - The cross-origin POST regression was deliberately observed failing without its guard. The production guard was restored and the API 35 regression passes. - Portable Swift production-policy tests: 7 passed (URL and typed metadata). All Swift sources passed format lint and parsing with Swift 6.2.1 on Linux. The portable package excludes BrowserModelTests. This does not build iOS. - Selected upstream suites ran successfully: cookie-secure-flag (4), session-sliding (8), two-factor (22), password-reset (24), sw-api-cache (42). Upstream's plain OIDC script also exited successfully. These are upstream tests, not evidence of a provider round-trip or native push support. - The HTTPS harness independently passed upstream OIDC discovery, RS256 ID-token signature/nonce validation, S256 PKCE exchange and session creation with a local test IdP. The fixture checks single-use codes, exact redirect URIs and OAuth Basic client authentication. Loopback hosts/ports and automatic fixture consent are not representative of every provider's cross-site/embedded-agent policies. - OSV: no listed advisories for **213** locked/direct Maven coordinates and build plugins at scan time. This is not a guarantee that no vulnerabilities exist. - ktlint 1.7.1, actionlint 1.7.7, repository invariants, Python compilation, Node syntax and shell syntax checks passed. JUnit-verifier regression suite: **8 passed**, including rejection of absent, empty, malformed, insufficient, failed, errored and skipped evidence. - Release APK inspection confirms API 26 minimum / API 37 target, no debuggable flag, backups and cleartext disabled, system-only certificate trust. Exported entry points are the launcher and AndroidX ProfileInstallReceiver protected by the system DUMP permission; file/startup providers are not exported. Debug APK signature verifies; release APK/AAB are unsigned. Collected archives contain no fixture CA/key or signing-key files. ## Emulator limitations and retry evidence Earlier extended-suite attempts crashed the host emulator with SIGSEGV under software/off GPU modes. Host-GPU mode remained running and produced actionable JUnit failures: an OIDC-return synchronization timeout, followed by an outage assertion that incorrectly assumed the upstream worker could not serve its cached app shell, then a document-readiness race after recreation. Tests now verify the loaded JavaScript origin, wait for the sign-in window to close, retry only a probe lost to document replacement and exercise recovery through uncached metadata. The completed retry passes all seven tests without disabling the worker or weakening production TLS/CSP/origin policies. API 37 attempts encountered broken package/activity services and locked credential-encrypted storage. **No API 37 runtime pass is claimed.** Local logs and reports live in `/home/neste/yuvomi-build/`; test XML is under `app/outputs/androidTest-results/connected/`. Earlier failing JUnit snapshots are preserved as `integration-host-gpu-oidc-race.xml` and `integration-host-gpu-sw-cache.xml`, plus `integration-host-gpu-document-ready.xml`. Passing evidence is preserved in `integration-api35-first-pass.xml` and `integration-api35-repeat-pass.xml`; logs are `upstream-integration-final-retry.log` and `upstream-integration-repeat.log`. These files are local evidence, not published artifacts or a hosted CI result. Test environment: JDK 17.0.20.1, Node 22.22.1, Python 3.14.4, Android Emulator 37.2.12, API 35 x86_64 Google APIs image, WebView 124.0.6367.219. The old bundled WebView is useful compatibility evidence, not a recommendation to use an unpatched engine; a current engine/device run remains mandatory. ## Artifacts Ignored `artifacts/android/` contains the development-signed debug APK and unsigned release APK/AAB, `SHA256SUMS`, `build-info.json` and manifest/policy/signature inspection evidence. No integration APK is collected. No IPA or Apple archive exists. See [Android build](build-android.md) for repeatable collection commands. ## Commands ```sh bash android/gradlew -p android testDebugUnitTest lintDebug lintRelease assembleDebug assembleRelease bundleRelease connectedDebugAndroidTest python3 scripts/test-integration.py /path/to/pinned-upstream --android swift test --package-path ios swiftc -frontend -parse ios/Sources/*.swift ios/Tests/*.swift ios/UITests/*.swift python3 scripts/check-repository.py python3 scripts/check-dependencies.py python3 scripts/test-verifier.py python3 scripts/collect-android-artifacts.py git diff --check ``` This environment is Linux/WSL. Android SDK and a KVM emulator were installed for real execution. Build output relocation was needed because the Windows mount rejects some Gradle POSIX metadata operations. Swift's Linux toolchain was installed for portable tests. No macOS, Xcode, Apple simulator or physical device is available; no iOS build/archive/UI result is claimed. ## Mandatory remaining evidence - Run Xcode build, XCTest/UI tests and unsigned archive on macOS; fix any compiler or runtime issues. The app has **not** yet been typechecked against Apple SDKs. - Validate real IdPs: cancellation, account linking, TOTP after OIDC, and embedded provider policy. Browser-only providers have no native-session handoff upstream. - Real-device camera/document picker cancellation, file MIME cases, rotation with an outstanding picker, network loss/reconnect, process kill/memory pressure, session expiry/revocation, OS backup, and offline account isolation. - Android 17 private-network permission grant/denial/revocation on a matching OS. Also run minimum-supported API 26 and a current OS/WebView device matrix. - VoiceOver/TalkBack, large text, contrast, keyboard/safe areas, reduced motion, light/dark appearance and responsive web modules on actual supported devices. - Successful CI runs on the configured Gitea runners, private security reporting contact, human security review, store ownership and production signing. No Firebase/APNs registration, closed-app push, offline editing, App Store approval, signing, publication or physical-device validation is claimed. See `SECURITY.md` and `docs/security-review.md` for residual limitations. Resume work using [maintainer continuation](continuation.md). ## Gitea runner adaptation Workflows now live in `.gitea/workflows/` and target the supplied `ubuntu-latest` pool and native `macos-arm64` M4 Pro runner. Local workflow grammar lint (Gitea URL syntax normalized), repository invariants, shell/Python syntax, ten mocked runner preflight regressions and eight evidence-verifier regressions pass. SHA-256 Git initialization/fetch was exercised locally; the pinned XcodeGen archive's checksum and native arm64 slice were verified. These are not remote runner execution or Apple SDK results. See [runner requirements](ci-runners.md); the local emulator preflight currently rejects unavailable/inaccessible KVM as designed. Original application build evidence above remains historical and is not a rebuild of the workflow-only changes.