Yuvomi-App/docs/validation.md

# Validation status

**Partially verified development software, not production-ready.**
Local validation date: 2026-10-21. No unexecuted iOS application test, hosted CI
run, production signing, or store publication is represented as completed.

## Executed evidence

- Android debug APK and unsigned release APK/AAB built successfully; both
  `lintDebug` and `lintRelease` passed. JVM security/picker-policy tests: **7 passed,
  zero failures/skips**.
- Android API 35 regular emulator suite: **6 passed, zero failures/skips**.
  This covers onboarding, invalid URLs, background/resume, hardened settings,
  cross-origin POST/subresource isolation, opaque-page Blob rejection and activity
  recreation. Its permission test checks that the API 37 permission UI is absent;
  it is **not** evidence of API 37 permission grant/denial behavior.
- Unmodified pinned upstream ran behind a temporary HTTPS reverse proxy.
  Bootstrap metadata, password login, Secure/HttpOnly/SameSite cookies, persistent
  session, CSRF rejection, logout/revocation passed in the harness.
- Android's extended real-server scenario exercises login, HttpOnly cookies,
  document upload via upstream fetch, native FileTransfer output, bounded Blob
  export, background/resume, recreation, CSRF-protected logout, revocation,
  recovery, isolated OIDC return and back navigation. It does not automate the OS
  camera/document destination picker or prove every upstream module works.
  Two consecutive API 35 runs have **7 passed, zero failures/skips each**, including the
  six regular security/onboarding cases and this real-server scenario.
- The cross-origin POST regression was deliberately observed failing without its
  guard. The production guard was restored and the API 35 regression passes.
- Portable Swift production-policy tests: 7 passed (URL and typed metadata).
  All Swift sources passed format lint and parsing with Swift 6.2.1 on Linux.
  The portable package excludes BrowserModelTests. This does not build iOS.
- Selected upstream suites ran successfully: cookie-secure-flag (4),
  session-sliding (8), two-factor (22), password-reset (24), sw-api-cache (42).
  Upstream's plain OIDC script also exited successfully. These are upstream tests,
  not evidence of a provider round-trip or native push support.
- The HTTPS harness independently passed upstream OIDC discovery, RS256 ID-token
  signature/nonce validation, S256 PKCE exchange and session creation with a local
  test IdP. The fixture checks single-use codes, exact redirect URIs and OAuth
  Basic client authentication. Loopback hosts/ports and automatic fixture consent
  are not representative of every provider's cross-site/embedded-agent policies.
- OSV: no listed advisories for **213** locked/direct Maven coordinates and build
  plugins at scan time. This is not a guarantee that no vulnerabilities exist.
- ktlint 1.7.1, actionlint 1.7.7, repository invariants, Python compilation,
  Node syntax and shell syntax checks passed. JUnit-verifier regression suite:
  **8 passed**, including rejection of absent, empty, malformed, insufficient,
  failed, errored and skipped evidence.
- Release APK inspection confirms API 26 minimum / API 37 target, no debuggable
  flag, backups and cleartext disabled, system-only certificate trust. Exported
  entry points are the launcher and AndroidX ProfileInstallReceiver protected by
  the system DUMP permission; file/startup providers are not exported. Debug APK
  signature verifies; release APK/AAB are unsigned. Collected archives contain no
  fixture CA/key or signing-key files.

## Emulator limitations and retry evidence

Earlier extended-suite attempts crashed the host emulator with SIGSEGV under
software/off GPU modes. Host-GPU mode remained running and produced actionable
JUnit failures: an OIDC-return synchronization timeout, followed by an outage
assertion that incorrectly assumed the upstream worker could not serve its cached
app shell, then a document-readiness race after recreation. Tests now verify the
loaded JavaScript origin, wait for the sign-in window to close, retry only a probe
lost to document replacement and exercise recovery through uncached metadata.
The completed retry passes all seven tests without disabling the worker or
weakening production TLS/CSP/origin policies.

API 37 attempts encountered broken package/activity services and locked
credential-encrypted storage. **No API 37 runtime pass is claimed.**

Local logs and reports live in `/home/neste/yuvomi-build/`; test XML is under
`app/outputs/androidTest-results/connected/`. Earlier failing JUnit snapshots are
preserved as `integration-host-gpu-oidc-race.xml` and
`integration-host-gpu-sw-cache.xml`, plus
`integration-host-gpu-document-ready.xml`. Passing evidence is preserved in
`integration-api35-first-pass.xml` and `integration-api35-repeat-pass.xml`; logs are
`upstream-integration-final-retry.log` and `upstream-integration-repeat.log`.
These files are local evidence, not published
artifacts or a hosted CI result.

Test environment: JDK 17.0.20.1, Node 22.22.1, Python 3.14.4, Android Emulator
37.2.12, API 35 x86_64 Google APIs image, WebView 124.0.6367.219. The old bundled
WebView is useful compatibility evidence, not a recommendation to use an unpatched
engine; a current engine/device run remains mandatory.

## Artifacts

Ignored `artifacts/android/` contains the development-signed debug APK and unsigned
release APK/AAB, `SHA256SUMS`, `build-info.json` and manifest/policy/signature
inspection evidence. No integration APK is collected. No IPA or Apple archive
exists. See [Android build](build-android.md) for repeatable collection commands.

## Commands

```sh
bash android/gradlew -p android testDebugUnitTest lintDebug lintRelease assembleDebug assembleRelease bundleRelease connectedDebugAndroidTest
python3 scripts/test-integration.py /path/to/pinned-upstream --android
swift test --package-path ios
swiftc -frontend -parse ios/Sources/*.swift ios/Tests/*.swift ios/UITests/*.swift
python3 scripts/check-repository.py
python3 scripts/check-dependencies.py
python3 scripts/test-verifier.py
python3 scripts/collect-android-artifacts.py
git diff --check
```

This environment is Linux/WSL. Android SDK and a KVM emulator were installed for
real execution. Build output relocation was needed because the Windows mount
rejects some Gradle POSIX metadata operations. Swift's Linux toolchain was
installed for portable tests. No macOS, Xcode, Apple simulator or physical device
is available; no iOS build/archive/UI result is claimed.

## Mandatory remaining evidence

- Run Xcode build, XCTest/UI tests and unsigned archive on macOS; fix any compiler
  or runtime issues. The app has **not** yet been typechecked against Apple SDKs.
- Validate real IdPs: cancellation, account linking, TOTP after OIDC, and embedded
  provider policy. Browser-only providers have no native-session handoff upstream.
- Real-device camera/document picker cancellation, file MIME cases, rotation with
  an outstanding picker, network loss/reconnect, process kill/memory pressure,
  session expiry/revocation, OS backup, and offline account isolation.
- Android 17 private-network permission grant/denial/revocation on a matching OS.
  Also run minimum-supported API 26 and a current OS/WebView device matrix.
- VoiceOver/TalkBack, large text, contrast, keyboard/safe areas, reduced motion,
  light/dark appearance and responsive web modules on actual supported devices.
- Operational CI runs on an authorized GitHub repository/runner, private security
  reporting contact, human security review, store ownership and production signing.

No Firebase/APNs registration, closed-app push, offline editing, App Store approval,
signing, publication or physical-device validation is claimed. See `SECURITY.md`
and `docs/security-review.md` for residual limitations.
Resume work using [maintainer continuation](continuation.md).