# Native validation

**Incomplete native rebuild; not full PWA parity and not production-ready.**
The old browser results are [historical only](legacy-wrapper-validation.md).

The new shipping surfaces are Android Compose and iOS SwiftUI. Current native
tests are in `androidTestNative` / `androidTestNativeIntegration`, JVM native policy
tests, and Swift production contracts/transport tests. Archived WebView tests are
not included in the native suites or counted toward native completion.

## Executed locally — 2026-10-21

| Check | Observed result |
| --- | --- |
| Android JVM tests | 10 passed; zero failed/skipped |
| Native Compose UI/security suite, API 35 emulator | 6 passed; zero failed/skipped |
| Real-upstream native integration suite | 7 passed; zero failed/skipped (the same 6 onboarding tests plus 1 multi-step real-server scenario) |
| Native scenario | Login/dashboard, activity recreation, task/note/list/item creation and API readback, redirect refusal, logout and vault erasure |
| Integration screenshot export | Successful AGP test-output collection; native dashboard PNG opened and visually confirmed nonblank, synthetic data only |
| Android lint | Debug and release passed; newer-version recommendations remain informational |
| Android packages | Debug APK and unsigned release APK/AAB built successfully |
| Swift portable suite | 16 passed; actual Foundation transport/contracts and URL/metadata policy, not Apple UI/Keychain execution |
| Swift formatting/parsing | Strict format lint and parsing passed, including Apple-only sources |
| Script regressions | 14 runner-preflight/Apple-probe, 8 JUnit-evidence and 5 screenshot-output tests passed |
| Repository/workflows | Source invariants, Python compilation, diff whitespace and actionlint for all 3 Gitea workflows passed |
| OSV | No listed advisories for 266 locked/direct Maven coordinates and plugins; not a security audit |

Environment: Linux/WSL, OpenJDK 17.0.20.1, Gradle 9.6.0, AGP 9.4.1,
Kotlin/Compose compiler 2.4.21, API 35 `sdk_gphone64_x86_64` emulator, Swift 6.2.1.
The host-only Tink upgrade to 1.15.0 removes the observed obsolete generated
protobuf warning; the final Android validation log has no such warning.

The first integration attempt missed the scrolled-off login button. Later,
post-uninstall screenshot retrieval failed, and the first compositor capture was
black. The final test scrolls the real button, uses native-window capture with a
nonblank-pixel assertion and writes through `PlatformTestStorageRegistry` for AGP
collection. The latest complete harness exits successfully, not just its JUnit
subprocess. Ordinary builds retain screenshot protection.

The unmodified pinned upstream HTTPS/OIDC protocol fixture also passed TLS trust,
metadata, cookies, CSRF and remote revocation checks. Its IdP exchange is **not
native SSO**: the native client refuses the redirect and SSO remains pending.

Evidence paths in the local external build directory:

- `app/test-results/testDebugUnitTest/`
- `app/outputs/androidTest-results/connected/{debug,integration}/`
- `app/outputs/native-screenshots/native-dashboard.png`
- `app/reports/lint-results-{debug,release}.html`
- Logs: `/home/neste/yuvomi-native-validation.log`,
  `/home/neste/yuvomi-native-integration-final.log`,
  `/home/neste/yuvomi-native-swift.log`.

## Observed Gitea results for source `40a7962`

- Android run #5 (global run 660), build job 1059: **success**, including packages,
  JVM/lint, formatting/repository/script checks, OSV and both artifact uploads.
- The actual `android-native-debug-apk` ZIP was downloaded. It contains exactly
  `app-debug.apk`, version `0.2.0-native-preview`/code 2; APK v2 signature verified,
  no fixture certificate/private-key files, installed and launched on the local
  authorized API-35 emulator. SHA-256 of the downloaded APK:
  `48d58ba5663b2e4fe563064efc567732e8ea35588cb610660f60406e82ccf610`.
  Its ephemeral CI debug certificate differs from the local development key, so
  its checksum intentionally differs from the locally collected APK.
- [Download the verified native debug artifact](https://git.nesterovic.cc/nessi/Yuvomi-App/actions/runs/660/artifacts/android-native-debug-apk)
  (repository access required; normal 14-day artifact retention applies).
- Remote jobs 1060/1061 (API 35/37.0): **failed preflight** because `/dev/kvm` was
  not exposed/writable. They executed no emulator tests. The matrix is not green.
- iOS run #6 (global 661), job 1062: verified native Node bootstrap and checkout
  **succeeded**. Xcode 27.1/build 27A9275 printed, but the subsequent Apple-tool
  preflight did not return during a 20-minute observation. No SwiftUI compile or
  simulator/XCTest/Keychain/device success is claimed. Bounded, named tool probes
  now fail with actionable diagnostics instead of silently hanging for the job's
  full hour; their actual next Mac result still needs inspection.

No Apple SDK application build, simulator UI test or physical-device result is
claimed from the Linux runs or the stalled Mac job. Runner prerequisites were
not weakened or counted as passing, and no host license/settings were changed.

## Commands

```sh
bash android/gradlew -p android testDebugUnitTest lintDebug lintRelease assembleDebug assembleRelease bundleRelease connectedDebugAndroidTest
python3 scripts/test-integration.py /path/to/pinned-upstream --android
swift test --package-path ios
swiftc -frontend -parse ios/Sources/*.swift ios/Tests/*.swift ios/UITests/*.swift
python3 scripts/check-repository.py
python3 scripts/check-dependencies.py
python3 scripts/lint-workflows.py /path/to/actionlint
```

On the local WSL checkout use `YUVOMI_BUILD_DIR=/home/neste/yuvomi-native-build`
and the SDK paths from [continuation](continuation.md). Select only the authorized
test emulator with `ANDROID_SERIAL=emulator-5554`; unrelated/unauthorized attached
devices are not test targets.

## External gates

Apple SDK builds, real supported devices/current engines, Android API 37, native
SSO/reset/invite protocols, permission/role cases, files/offline/notifications,
complete module and settings parity, visual baselines, accessibility and human
security review remain open. Missing modules are listed in
[native parity](native-parity.md), not silently represented as working.