Yuvomi-App/docs/validation.md

Native validation

Incomplete native rebuild; not full PWA parity and not production-ready. The old browser results are historical only.

The new shipping surfaces are Android Compose and iOS SwiftUI. Current native tests are in androidTestNative / androidTestNativeIntegration, JVM native policy tests, and Swift production contracts/transport tests. Archived WebView tests are not included in the native suites or counted toward native completion.

Executed locally — 2026-10-21

Check	Observed result
Android JVM tests	10 passed; zero failed/skipped
Native Compose UI/security suite, API 35 emulator	6 passed; zero failed/skipped
Real-upstream native integration suite	7 passed; zero failed/skipped (the same 6 onboarding tests plus 1 multi-step real-server scenario)
Native scenario	Login/dashboard, activity recreation, task/note/list/item creation and API readback, redirect refusal, logout and vault erasure
Integration screenshot export	Successful AGP test-output collection; native dashboard PNG opened and visually confirmed nonblank, synthetic data only
Android lint	Debug and release passed; newer-version recommendations remain informational
Android packages	Debug APK and unsigned release APK/AAB built successfully
Swift portable suite	16 passed; actual Foundation transport/contracts and URL/metadata policy, not Apple UI/Keychain execution
Swift formatting/parsing	Strict format lint and parsing passed, including Apple-only sources
Script regressions	14 runner-preflight/Apple-probe, 8 JUnit-evidence and 5 screenshot-output tests passed
Repository/workflows	Source invariants, Python compilation, diff whitespace and actionlint for all 3 Gitea workflows passed
OSV	No listed advisories for 266 locked/direct Maven coordinates and plugins; not a security audit

Environment: Linux/WSL, OpenJDK 17.0.20.1, Gradle 9.6.0, AGP 9.4.1, Kotlin/Compose compiler 2.4.21, API 35 sdk_gphone64_x86_64 emulator, Swift 6.2.1. The host-only Tink upgrade to 1.15.0 removes the observed obsolete generated protobuf warning; the final Android validation log has no such warning.

The first integration attempt missed the scrolled-off login button. Later, post-uninstall screenshot retrieval failed, and the first compositor capture was black. The final test scrolls the real button, uses native-window capture with a nonblank-pixel assertion and writes through PlatformTestStorageRegistry for AGP collection. The latest complete harness exits successfully, not just its JUnit subprocess. Ordinary builds retain screenshot protection.

The unmodified pinned upstream HTTPS/OIDC protocol fixture also passed TLS trust, metadata, cookies, CSRF and remote revocation checks. Its IdP exchange is not native SSO: the native client refuses the redirect and SSO remains pending.

Evidence paths in the local external build directory:

• app/test-results/testDebugUnitTest/
• app/outputs/androidTest-results/connected/{debug,integration}/
• app/outputs/native-screenshots/native-dashboard.png
• app/reports/lint-results-{debug,release}.html
• Logs: /home/neste/yuvomi-native-validation.log, /home/neste/yuvomi-native-integration-final.log, /home/neste/yuvomi-native-swift.log.

Observed Gitea results for source 40a7962

• Android run #5 (global run 660), build job 1059: success, including packages, JVM/lint, formatting/repository/script checks, OSV and both artifact uploads.
• The actual android-native-debug-apk ZIP was downloaded. It contains exactly app-debug.apk, version 0.2.0-native-preview/code 2; APK v2 signature verified, no fixture certificate/private-key files, installed and launched on the local authorized API-35 emulator. SHA-256 of the downloaded APK: 48d58ba5663b2e4fe563064efc567732e8ea35588cb610660f60406e82ccf610. Its ephemeral CI debug certificate differs from the local development key, so its checksum intentionally differs from the locally collected APK.
• Download the verified native debug artifact (repository access required; normal 14-day artifact retention applies).
• Remote jobs 1060/1061 (API 35/37.0): failed preflight because /dev/kvm was not exposed/writable. They executed no emulator tests. The matrix is not green.
• iOS run #6 (global 661), job 1062: verified native Node bootstrap and checkout succeeded. Xcode 27.1/build 27A9275 printed, but the subsequent Apple-tool preflight did not return during a 20-minute observation. No SwiftUI compile or simulator/XCTest/Keychain/device success is claimed. Bounded, named tool probes now fail with actionable diagnostics instead of silently hanging for the job's full hour; their actual next Mac result still needs inspection.

No Apple SDK application build, simulator UI test or physical-device result is claimed from the Linux runs or the stalled Mac job. Runner prerequisites were not weakened or counted as passing, and no host license/settings were changed.

Commands

bash android/gradlew -p android testDebugUnitTest lintDebug lintRelease assembleDebug assembleRelease bundleRelease connectedDebugAndroidTest
python3 scripts/test-integration.py /path/to/pinned-upstream --android
swift test --package-path ios
swiftc -frontend -parse ios/Sources/*.swift ios/Tests/*.swift ios/UITests/*.swift
python3 scripts/check-repository.py
python3 scripts/check-dependencies.py
python3 scripts/lint-workflows.py /path/to/actionlint

On the local WSL checkout use YUVOMI_BUILD_DIR=/home/neste/yuvomi-native-build and the SDK paths from continuation. Select only the authorized test emulator with ANDROID_SERIAL=emulator-5554; unrelated/unauthorized attached devices are not test targets.

External gates

Apple SDK builds, real supported devices/current engines, Android API 37, native SSO/reset/invite protocols, permission/role cases, files/offline/notifications, complete module and settings parity, visual baselines, accessibility and human security review remain open. Missing modules are listed in native parity, not silently represented as working.