Yuvomi-App/docs/validation.md

Native validation

Incomplete native rebuild; not full PWA parity and not production-ready. The old browser results are historical only.

The new shipping surfaces are Android Compose and iOS SwiftUI. Current native tests are in androidTestNative / androidTestNativeIntegration, JVM native policy tests, and Swift production contracts/transport tests. Archived WebView tests are not included in the native suites or counted toward native completion.

Executed locally — 2026-10-21

Check	Observed result
Android JVM tests	10 passed; zero failed/skipped
Native Compose UI/security suite, API 35 emulator	6 passed; zero failed/skipped
Real-upstream native integration suite	7 passed; zero failed/skipped (the same 6 onboarding tests plus 1 multi-step real-server scenario)
Native scenario	Login/dashboard, activity recreation, task/note/list/item creation and API readback, redirect refusal, logout and vault erasure
Integration screenshot export	Successful AGP test-output collection; native dashboard PNG opened and visually confirmed nonblank, synthetic data only
Android lint	Debug and release passed; newer-version recommendations remain informational
Android packages	Debug APK and unsigned release APK/AAB built successfully
Swift portable suite	16 passed; actual Foundation transport/contracts and URL/metadata policy, not Apple UI/Keychain execution
Swift formatting/parsing	Strict format lint and parsing passed, including Apple-only sources
Script regressions	14 runner-preflight/Apple-probe, 8 JUnit-evidence and 5 screenshot-output tests passed
Repository/workflows	Source invariants, Python compilation, diff whitespace and actionlint for all 3 Gitea workflows passed
OSV	No listed advisories for 266 locked/direct Maven coordinates and plugins; not a security audit

Environment: Linux/WSL, OpenJDK 17.0.20.1, Gradle 9.6.0, AGP 9.4.1, Kotlin/Compose compiler 2.4.21, API 35 sdk_gphone64_x86_64 emulator, Swift 6.2.1. The host-only Tink upgrade to 1.15.0 removes the observed obsolete generated protobuf warning; the final Android validation log has no such warning.

The first integration attempt missed the scrolled-off login button. Later, post-uninstall screenshot retrieval failed, and the first compositor capture was black. The final test scrolls the real button, uses native-window capture with a nonblank-pixel assertion and writes through PlatformTestStorageRegistry for AGP collection. The latest complete harness exits successfully, not just its JUnit subprocess. Ordinary builds retain screenshot protection.

The unmodified pinned upstream HTTPS/OIDC protocol fixture also passed TLS trust, metadata, cookies, CSRF and remote revocation checks. Its IdP exchange is not native SSO: the native client refuses the redirect and SSO remains pending.

Evidence paths in the local external build directory:

• app/test-results/testDebugUnitTest/
• app/outputs/androidTest-results/connected/{debug,integration}/
• app/outputs/native-screenshots/native-dashboard.png
• app/reports/lint-results-{debug,release}.html
• Logs: /home/neste/yuvomi-native-validation.log, /home/neste/yuvomi-native-integration-final.log, /home/neste/yuvomi-native-swift.log.

Observed Gitea results for source 40a7962

• Android run #5 (global run 660), build job 1059: success, including packages, JVM/lint, formatting/repository/script checks, OSV and both artifact uploads.
• The actual android-native-debug-apk ZIP was downloaded. It contains exactly app-debug.apk, version 0.2.0-native-preview/code 2; APK v2 signature verified, no fixture certificate/private-key files, installed and launched on the local authorized API-35 emulator. SHA-256 of the downloaded APK: 48d58ba5663b2e4fe563064efc567732e8ea35588cb610660f60406e82ccf610. Its ephemeral CI debug certificate differs from the local development key, so its checksum intentionally differs from the locally collected APK.
• Download the verified native debug artifact (repository access required; normal 14-day artifact retention applies).
• Remote jobs 1060/1061 (API 35/37.0): failed preflight because /dev/kvm was not exposed/writable. They executed no emulator tests. The matrix is not green.
• iOS run #6 (global 661), job 1062: verified native Node bootstrap and checkout succeeded. Xcode 27.1/build 27A9275 printed, but the subsequent Apple-tool preflight did not return during a 20-minute observation. No SwiftUI compile or simulator/XCTest/Keychain/device success is claimed. Bounded, named tool probes now fail with actionable diagnostics instead of silently hanging for the job's full hour.
• Follow-up iOS run #8 (global 663), job 1066 at 92dbd0e: Node, checkout, xcodebuild -version and xcrun --find swift passed. The exact blocker is xcrun simctl list devices available, which exceeded its 60-second deadline. Preflight correctly failed; application builds/tests/archive were skipped, not passed. The runner administrator must repair CoreSimulator availability for the runner user before Apple application validation can proceed.

No Apple SDK application build, simulator UI test or physical-device result is claimed from the Linux runs or the stalled Mac job. Runner prerequisites were not weakened or counted as passing, and no host license/settings were changed.

Commands

bash android/gradlew -p android testDebugUnitTest lintDebug lintRelease assembleDebug assembleRelease bundleRelease connectedDebugAndroidTest
python3 scripts/test-integration.py /path/to/pinned-upstream --android
swift test --package-path ios
swiftc -frontend -parse ios/Sources/*.swift ios/Tests/*.swift ios/UITests/*.swift
python3 scripts/check-repository.py
python3 scripts/check-dependencies.py
python3 scripts/lint-workflows.py /path/to/actionlint

On the local WSL checkout use YUVOMI_BUILD_DIR=/home/neste/yuvomi-native-build and the SDK paths from continuation. Select only the authorized test emulator with ANDROID_SERIAL=emulator-5554; unrelated/unauthorized attached devices are not test targets.

External gates

Apple SDK builds, real supported devices/current engines, Android API 37, native SSO/reset/invite protocols, permission/role cases, files/offline/notifications, complete module and settings parity, visual baselines, accessibility and human security review remain open. Missing modules are listed in native parity, not silently represented as working.