Yuvomi Mobile Contributors
4b483c20e3
Reproduce browser-success/native-401 with unmodified upstream SESSION_SECURE=false behind HTTPS. Keep cookies in the existing HTTPS-only origin-bound encrypted jar regardless of the server Secure attribute; preserve TLS, redirect, expiry and origin protections. Distinguish credential/2FA rejection from missing/rejected session handoff and clear stale login errors on retry. Verify 13 JVM tests plus the 7-test real-server suite in both Secure/default-cookie modes, including bad-password then successful native login. Bump Android preview to 0.2.1/code 3; extend CI and document the defect without claiming access to the user's production server.
4.2 KiB
YUVOMI MOBILE – FINAL DELIVERY REPORT
Delivery status: incomplete native preview, not final product acceptance. This report closes the initial native rebuild slice, not the requested complete 1:1 replacement. No module has accepted functional and visual parity.
Follow-up: Android 0.2.1 native preview (code 3) fixes a reproduced session-cookie login compatibility defect. See login troubleshooting and the newer validation evidence; the original 0.2.0 results below remain historical evidence, not a replacement for the fixed APK.
1. Outcome
The rejected embedded-browser application has been replaced by genuine native shipping entry points. Missing modules do not fall back to a WebView.
2. Upstream reference
Unmodified Yuvomi 2.78.0, commit
10bfef7686ed7303b4c74c7fcc55a5eb16356c9d. No upstream change or push.
3. Android
Kotlin/Compose onboarding, setup/password/TOTP interfaces, basic dashboard,
tasks/notes/shopping and session management. Version 0.2.0-native-preview,
code 2. This is a tested initial slice, not full module coverage.
4. iOS
SwiftUI equivalents, native API models/transport and Keychain storage implemented. Sixteen portable tests pass; Apple SDK application/UI/Keychain validation remains unverified locally. No installable IPA or App Store-ready archive is claimed.
5. Design parity
Upstream colors, spacing/radii and brand geometry guide native controls. One real synthetic Android dashboard screenshot was inspected. No side-by-side full PWA visual acceptance, complete adaptive-layout or accessibility approval yet.
6. API and architecture
Direct same-origin HTTPS/JSON, native controls and state; server-owned business
logic and authorization. Superseded browser code/tests are preserved in legacy/
but excluded from shipping builds and native test counts.
7. Security
System TLS, redirect refusal, bounded reads, upstream CSRF and protected native cookies. AndroidKeyStore/AES-GCM and iOS Keychain/private URLSession storage; no stored passwords, test CA in ordinary builds or hidden browser session import. Human security review and additional device/role/error-path coverage remain open.
8. Executed validation
10 JVM tests, 6 native API-35 UI tests, the 7-test real-server suite (including those same 6), both Android lint variants and package builds pass. Swift has 16 portable passes plus strict formatting/parsing. 27 script regressions, repository checks, workflow lint and the 266-coordinate OSV scan pass. See validation for evidence, failures corrected and exact limitations.
9. Artifacts
The local collector replaces old wrapper outputs in ignored artifacts/android/
with native debug APK and unsigned release APK/AAB, checksums and manifest/network/
signature inspection. build-info.json records exact source identity and dirty
state. Only the development-signed debug APK is installable as provided.
10. Gitea CI
Android build job 1059 succeeded and uploaded android-native-debug-apk. The actual
artifact was downloaded, signature/version checked, installed and launched on the
authorized local emulator. Download the verified artifact.
Mac Node bootstrap, checkout and Swift lookup now succeed, but
xcrun simctl list devices available times out after 60 seconds in follow-up job
1066. The runner's CoreSimulator availability needs administrator repair. The remote emulator matrix
still fails missing-KVM preflight, not native tests. No green whole-pipeline or
Apple application validation is claimed. See validation.
11. Signing and publication
Initial owner-authorized signing material/secrets are preserved privately; signing workflow changes remain parked in the named stash. No production-signed native release, store submission or claim of completed product delivery.
12. Remaining work
Native SSO/recovery/invitations, advanced first-slice controls, the remaining modules/settings, files, offline, notifications, Apple/device validation and 1:1 visual/behavior acceptance remain substantial work. The complete page inventory and acceptance criteria are in native parity.