Yuvomi-App/docs/continuation.md

Maintainer continuation

This is a development delivery, not authorization to publish. Preserve the Git history on feat/yuvomi-mobile; use Conventional Commits and normal pushes only. The authorized community remote is https://git.nesterovic.cc/nessi/Yuvomi-App. Do not push, submit issues or open pull requests against upstream on this task's behalf. No production credentials or store accounts have been provided.

Start with the evidence

Read validation, security review, and release gates. Do not repeat completed implementation work or equate portable Swift checks with an iOS app build. Inspect git status before editing; preserve any newer maintainer changes.

The upstream reference is Yuvomi 2.78.0 at 10bfef7686ed7303b4c74c7fcc55a5eb16356c9d. Keep it unmodified. Subpath hosting, browser-to-native OIDC handoff and native remote push are not implemented.

The extended API 35 HTTPS suite passes all seven tests, including the local-IdP round trip, native transfers, recovery and back navigation. Portable Swift has seven passing policy tests; the separate JUnit verifier has eight regressions. Keep the fixture's scope separate from real-provider or Apple-platform validation.

Persistent local environment (Linux/WSL)

• Repository: /mnt/c/Users/neste/Documents/GIT/Yuvomi-App.
• Upstream and installed dependencies: /home/neste/yuvomi-tools/upstream.
• SDK: /home/neste/yuvomi-tools/android-toolchain/android-sdk.
• Build outputs/logs: /home/neste/yuvomi-build.
• Swift 6.2.1: /home/neste/yuvomi-tools/swift-6.2.1-RELEASE-ubuntu24.04/usr/bin.
• Swift compatibility libraries: /home/neste/yuvomi-tools/compat/usr/lib/x86_64-linux-gnu.
• Swift scratch output: /home/neste/yuvomi-swift-build.
• ktlint and actionlint: /home/neste/yuvomi-tools/ktlint.jar and /home/neste/yuvomi-tools/actionlint.
• Local collected artifacts/evidence: ignored artifacts/android/.

/tmp/opencode is temporary and was cleared by server restarts. Background processes may also disappear. Keep durable logs under /home/neste; never persist the integration fixture's generated private CA, keys or real household data.

export ANDROID_HOME=/home/neste/yuvomi-tools/android-toolchain/android-sdk
export YUVOMI_BUILD_DIR=/home/neste/yuvomi-build
"$ANDROID_HOME/platform-tools/adb" devices -l
"$ANDROID_HOME/platform-tools/adb" shell am get-started-user-state 0
# Require RUNNING_UNLOCKED, then:
python3 scripts/test-integration.py /home/neste/yuvomi-tools/upstream --android
bash android/gradlew -p android testDebugUnitTest lintDebug lintRelease assembleDebug assembleRelease bundleRelease
python3 scripts/collect-android-artifacts.py

The API 35 AVD is yuvomi-test. Its stable attempt uses KVM, -gpu host, -no-window -no-audio -no-boot-anim -no-snapshot -memory 2560 -cores 2. Launch under the SDK/AVD owner with access to the kvm group. Other GPU modes previously crashed the host emulator with SIGSEGV. API 37 had broken services and locked credential-encrypted storage; no API 37 runtime success is claimed.

For portable Swift checks add the compiler directory to PATH and set LD_LIBRARY_PATH to the compatibility-library directory above, then use the commands in iOS development. Apple application/XCTest/UI/archive validation must happen on macOS with Xcode and real supported devices.

Highest-priority external work

1. Typecheck/build the iOS app against Apple SDKs, run its actual XCTest/UI tests, and produce an unsigned archive. Fix any failures; none of these ran locally.
2. Run the API 37 permission grant/denial/revocation scenarios on a working image or device, plus the minimum-supported Android and current WebView matrix.
3. Review iOS unknown-length download disk-pressure handling before release.
4. Validate real supported IdPs, TOTP after SSO, linking, cancellation, native file/camera pickers, process death, accessibility and offline account isolation.
5. Establish private vulnerability reporting, owned identifiers, authorized CI, human security review and owner-controlled signing before any distribution.

The provided GitHub Actions workflows do not automatically execute on the current non-GitHub forge. Do not claim hosted CI or store readiness without actual runs.