SHA256
234 lines
14 KiB
Markdown
234 lines
14 KiB
Markdown
# Native validation
|
||
|
||
**Incomplete native rebuild; not full PWA parity and not production-ready.**
|
||
The old browser results are [historical only](legacy-wrapper-validation.md).
|
||
|
||
The new shipping surfaces are Android Compose and iOS SwiftUI. Current native
|
||
tests are in `androidTestNative` / `androidTestNativeIntegration`, JVM native policy
|
||
tests, and Swift production contracts/transport tests. Archived WebView tests are
|
||
not included in the native suites or counted toward native completion.
|
||
|
||
## Android 0.2.2 / code 4: PWA-derived design pass
|
||
|
||
Local API-35 validation after the design pass:
|
||
|
||
| Check | Observed result |
|
||
| --- | --- |
|
||
| JVM policy/presentation tests | 23 passed, zero failures/errors/skips |
|
||
| Native Compose UI/security/presentation tests | 9 passed, zero failures/errors/skips |
|
||
| Real upstream, default non-Secure cookie over HTTPS | 10 passed, zero failures/errors/skips |
|
||
| Real upstream, Secure cookie | 10 passed, zero failures/errors/skips |
|
||
| Android lint and packages | Both lint variants; debug and unsigned release APK/AAB passed |
|
||
| Screenshot evidence | Ten light/dark native views, viewport metadata, ten actual-PWA references and ten matched-size side-by-side images |
|
||
| Script checks | 9 screenshot-collection, 8 JUnit-verifier and 14 runner/probe regressions passed; repository/Python/Node/workflow checks passed |
|
||
| Dependency scan | OSV listed no advisories for 266 locked/direct Maven coordinates/plugins |
|
||
|
||
The first ordinary device-test attempt ran **zero tests** because a leftover
|
||
CI-signed 0.2.1 preview had a different debug certificate. The verifier rejected
|
||
that run despite Gradle's successful exit. AGP cleanup removed the package; the
|
||
clean rerun executed all nine tests. Both complete integration harnesses then
|
||
exited successfully and retained the rejected-password/successful-retry regression.
|
||
|
||
Logs: `/home/neste/yuvomi-design-build-final.log`,
|
||
`/home/neste/yuvomi-design-cookie-final.log`,
|
||
`/home/neste/yuvomi-design-secure-final.log`.
|
||
The [design comparison](native-design.md) includes reviewed synthetic images and
|
||
documents the exact 360 × 592 content viewport and intentional fixture scope.
|
||
**This is not accepted 1:1 parity.** iOS was not changed in this design pass.
|
||
Remote Android KVM prerequisites and production signing remain open. The earlier
|
||
Mac blocker has since cleared, as verified below.
|
||
|
||
A separate `git archive` checkout of committed source `7ac9882` was rebuilt at
|
||
`/tmp/opencode/yuvomi-design-clean-1fknxqpt`, with outputs under
|
||
`/home/neste/yuvomi-design-clean-build-7ac9882`. JVM tests, both lint variants and
|
||
debug/unsigned release APK/AAB builds succeeded (`/home/neste/yuvomi-design-clean-build.log`).
|
||
The artifact collector verified version/code, debug signature, unsigned release
|
||
outputs, production TLS-only/system-CA policy and absence of test certificates or
|
||
private signing files. Local copies are in ignored `artifacts/android/`. Collection
|
||
records the documentation-only dirty worktree honestly; the build itself used the
|
||
clean committed-source archive, not those later documentation edits.
|
||
|
||
### Downloaded and installed CI artifact
|
||
|
||
Gitea Android run **670**, build job **1079**, source `7ac9882`: the build/test/lint,
|
||
repository/script/format/dependency checks and artifact upload succeeded. The
|
||
actual ZIP was downloaded; its sole `app-debug.apk` is
|
||
`0.2.2-native-preview` / code **4**, and `apksigner` verified its signature. No
|
||
fixture certificate or private signing files were present. The downloaded APK was
|
||
then installed and cold-launched successfully on authorized `emulator-5554`.
|
||
|
||
- [Download Android 0.2.2 native preview](https://git.nesterovic.cc/nessi/Yuvomi-App/actions/runs/670/artifacts/android-native-debug-apk)
|
||
- APK SHA-256: `6efea6c2fbafc0702f6cd8c665817dd93a1d63590b00da4def09d246df900e44`
|
||
- Local downloaded copy/verification: ignored `artifacts/android-ci-670/`.
|
||
- The CI debug certificate differs from the local development certificate. Only
|
||
the known synthetic local preview was removed for this installation. A user
|
||
whose older preview has a different debug certificate may need to uninstall it
|
||
before installing this APK and then log in again; server data is not deleted.
|
||
|
||
The whole Android run is **not green**: emulator jobs **1080/1081** failed preflight
|
||
because `/dev/kvm` is not exposed/read-write accessible inside their jobs. Their
|
||
logs explicitly report this prerequisite; no remote emulator pass is claimed.
|
||
All device-test results above are the actual local API-35 executions.
|
||
|
||
### Verified Apple runner recovery
|
||
|
||
Inspection of Gitea run 669/job 1078 at `bd0e4cc` found an actual successful Apple
|
||
run, not just green bootstrap steps. The downloaded job log contains:
|
||
|
||
- Successful bounded `simctl` preflight and native app simulator compilation.
|
||
- 16 portable tests, then 16 simulator XCTest tests with zero failures.
|
||
- One `OnboardingTests.testRejectsCleartextWithoutNetwork` UI test, zero failures;
|
||
it checks cleartext rejection and absence of a WebView in the native hierarchy.
|
||
- `** TEST SUCCEEDED **` and `** ARCHIVE SUCCEEDED **` for the explicitly unsigned
|
||
generic-iOS device archive.
|
||
|
||
Log retained outside Git: `/home/neste/yuvomi-ios-job-1078.log`. This supersedes the
|
||
earlier CoreSimulator timeout as a **current** blocker, while leaving its historical
|
||
diagnosis intact. It is not a native login/CRUD, Keychain runtime, real-device or
|
||
visual-parity certification, nor an installable signed iOS distribution.
|
||
The current design source `7ac9882` also completed the same Apple checks in run
|
||
671/job 1082. Its downloaded log again contains the 16-test XCTest and one-test
|
||
onboarding successes plus `TEST SUCCEEDED` / `ARCHIVE SUCCEEDED` markers
|
||
(`/home/neste/yuvomi-ios-job-1082.log`). The iOS UI itself is unchanged.
|
||
|
||
## Android 0.2.1 / code 3: reproduced login regression
|
||
|
||
The user reported immediate login failure despite a working direct browser login.
|
||
The root cause was reproduced using upstream's `SESSION_SECURE=false` default over
|
||
HTTPS: browser/protocol login succeeded, but the old Android jar discarded the
|
||
session cookie and its next authenticated API request failed. The fixed jar binds
|
||
all cookies to HTTPS itself instead of requiring this optional server attribute.
|
||
HTTP, cross-origin requests/redirects, invalid certificates, plaintext persistence
|
||
and session-only cookie persistence remain disallowed.
|
||
|
||
- Before-fix failure retained in `/home/neste/yuvomi-login-cookie-before.log` and
|
||
`/home/neste/yuvomi-login-cookie-before.xml` (synthetic fixture only).
|
||
- After-fix upstream-default cookie mode: 7 instrumentation tests passed,
|
||
zero failures/skips; complete harness exited successfully.
|
||
- Secure-cookie mode: the same 7 tests passed, zero failures/skips.
|
||
- Both modes test a rejected password followed by successful retry with no stale
|
||
error, native dashboard/recreation, task/note/shopping calls and logout.
|
||
- 13 JVM tests passed, including default-cookie persistence/deletion, expired/empty
|
||
session detection and separate credential/2FA/session-handoff error messages.
|
||
- Both lint variants, debug/unsigned release APK/AAB builds and the 6-test ordinary
|
||
native UI suite passed. Its first attempt hit a leftover CI-debug certificate
|
||
mismatch and produced zero tests; the verifier correctly rejected it. After
|
||
confirming the fixture package was absent, the rerun executed all 6 with no
|
||
failures/skips (`/home/neste/yuvomi-login-debug-retry.log`).
|
||
- Logs: `/home/neste/yuvomi-login-cookie-after.log`,
|
||
`/home/neste/yuvomi-login-secure-after.log`, `/home/neste/yuvomi-login-unit.log`,
|
||
`/home/neste/yuvomi-login-validation.log`.
|
||
- Gitea run #11/global 666, build job 1071 at `4b483c2`: packages, JVM/lint,
|
||
repository/script/format checks, OSV and artifact uploads all succeeded.
|
||
- [Download fixed Android 0.2.1/code 3](https://git.nesterovic.cc/nessi/Yuvomi-App/actions/runs/666/artifacts/android-native-debug-apk).
|
||
The ZIP was downloaded and its sole APK version/v2 signature checked; it was
|
||
installed and launched on the authorized local emulator. APK SHA-256:
|
||
`a769118f0bd16988f76a8ee95c0aa0c5e248104e8ea529eee2e0c83d78b6ca5a`.
|
||
This does not certify the still-blocked remote emulator matrix or Apple pipeline.
|
||
|
||
See [login troubleshooting](login-troubleshooting.md). This reproduces a matching
|
||
compatibility defect without accessing the user's server or credentials; it does
|
||
not claim inspection of that particular server's configuration.
|
||
|
||
## Initial 0.2.0 preview evidence — 2026-10-21
|
||
|
||
| Check | Observed result |
|
||
| --- | --- |
|
||
| Android JVM tests | 10 passed; zero failed/skipped |
|
||
| Native Compose UI/security suite, API 35 emulator | 6 passed; zero failed/skipped |
|
||
| Real-upstream native integration suite | 7 passed; zero failed/skipped (the same 6 onboarding tests plus 1 multi-step real-server scenario) |
|
||
| Native scenario | Login/dashboard, activity recreation, task/note/list/item creation and API readback, redirect refusal, logout and vault erasure |
|
||
| Integration screenshot export | Successful AGP test-output collection; native dashboard PNG opened and visually confirmed nonblank, synthetic data only |
|
||
| Android lint | Debug and release passed; newer-version recommendations remain informational |
|
||
| Android packages | Debug APK and unsigned release APK/AAB built successfully |
|
||
| Swift portable suite | 16 passed; actual Foundation transport/contracts and URL/metadata policy, not Apple UI/Keychain execution |
|
||
| Swift formatting/parsing | Strict format lint and parsing passed, including Apple-only sources |
|
||
| Script regressions | 14 runner-preflight/Apple-probe, 8 JUnit-evidence and 5 screenshot-output tests passed |
|
||
| Repository/workflows | Source invariants, Python compilation, diff whitespace and actionlint for all 3 Gitea workflows passed |
|
||
| OSV | No listed advisories for 266 locked/direct Maven coordinates and plugins; not a security audit |
|
||
|
||
Environment: Linux/WSL, OpenJDK 17.0.20.1, Gradle 9.6.0, AGP 9.4.1,
|
||
Kotlin/Compose compiler 2.4.21, API 35 `sdk_gphone64_x86_64` emulator, Swift 6.2.1.
|
||
The host-only Tink upgrade to 1.15.0 removes the observed obsolete generated
|
||
protobuf warning; the final Android validation log has no such warning.
|
||
|
||
The first integration attempt missed the scrolled-off login button. Later,
|
||
post-uninstall screenshot retrieval failed, and the first compositor capture was
|
||
black. The final test scrolls the real button, uses native-window capture with a
|
||
nonblank-pixel assertion and writes through `PlatformTestStorageRegistry` for AGP
|
||
collection. The latest complete harness exits successfully, not just its JUnit
|
||
subprocess. Ordinary builds retain screenshot protection.
|
||
|
||
The unmodified pinned upstream HTTPS/OIDC protocol fixture also passed TLS trust,
|
||
metadata, cookies, CSRF and remote revocation checks. Its IdP exchange is **not
|
||
native SSO**: the native client refuses the redirect and SSO remains pending.
|
||
|
||
Evidence paths in the local external build directory:
|
||
|
||
- `app/test-results/testDebugUnitTest/`
|
||
- `app/outputs/androidTest-results/connected/{debug,integration}/`
|
||
- `app/outputs/native-screenshots/native-dashboard.png`
|
||
- `app/reports/lint-results-{debug,release}.html`
|
||
- Logs: `/home/neste/yuvomi-native-validation.log`,
|
||
`/home/neste/yuvomi-native-integration-final.log`,
|
||
`/home/neste/yuvomi-native-swift.log`.
|
||
|
||
## Observed Gitea results for source `40a7962`
|
||
|
||
- Android run #5 (global run 660), build job 1059: **success**, including packages,
|
||
JVM/lint, formatting/repository/script checks, OSV and both artifact uploads.
|
||
- The actual `android-native-debug-apk` ZIP was downloaded. It contains exactly
|
||
`app-debug.apk`, version `0.2.0-native-preview`/code 2; APK v2 signature verified,
|
||
no fixture certificate/private-key files, installed and launched on the local
|
||
authorized API-35 emulator. SHA-256 of the downloaded APK:
|
||
`48d58ba5663b2e4fe563064efc567732e8ea35588cb610660f60406e82ccf610`.
|
||
Its ephemeral CI debug certificate differs from the local development key, so
|
||
its checksum intentionally differs from the locally collected APK.
|
||
- [Download the verified native debug artifact](https://git.nesterovic.cc/nessi/Yuvomi-App/actions/runs/660/artifacts/android-native-debug-apk)
|
||
(repository access required; normal 14-day artifact retention applies).
|
||
- Remote jobs 1060/1061 (API 35/37.0): **failed preflight** because `/dev/kvm` was
|
||
not exposed/writable. They executed no emulator tests. The matrix is not green.
|
||
- iOS run #6 (global 661), job 1062: verified native Node bootstrap and checkout
|
||
**succeeded**. Xcode 27.1/build 27A9275 printed, but the subsequent Apple-tool
|
||
preflight did not return during a 20-minute observation. No SwiftUI compile or
|
||
simulator/XCTest/Keychain/device success is claimed. Bounded, named tool probes
|
||
now fail with actionable diagnostics instead of silently hanging for the job's
|
||
full hour.
|
||
- Follow-up iOS run #8 (global 663), job 1066 at `92dbd0e`: Node, checkout,
|
||
`xcodebuild -version` and `xcrun --find swift` passed. The exact blocker is
|
||
**`xcrun simctl list devices available`**, which exceeded its 60-second deadline.
|
||
Preflight correctly failed; application builds/tests/archive were skipped, not
|
||
passed. The runner administrator must repair CoreSimulator availability for the
|
||
runner user before Apple application validation can proceed.
|
||
|
||
At that point no Apple SDK application build or simulator UI result was available
|
||
from the Linux runs or stalled Mac job. The later verified run 669 above supersedes
|
||
that limitation for compilation/basic simulator tests/archive only. No physical-
|
||
device result is claimed. Runner prerequisites were not weakened, and this agent
|
||
did not change host license/settings.
|
||
|
||
## Commands
|
||
|
||
```sh
|
||
bash android/gradlew -p android testDebugUnitTest lintDebug lintRelease assembleDebug assembleRelease bundleRelease connectedDebugAndroidTest
|
||
python3 scripts/test-integration.py /path/to/pinned-upstream --android
|
||
swift test --package-path ios
|
||
swiftc -frontend -parse ios/Sources/*.swift ios/Tests/*.swift ios/UITests/*.swift
|
||
python3 scripts/check-repository.py
|
||
python3 scripts/check-dependencies.py
|
||
python3 scripts/lint-workflows.py /path/to/actionlint
|
||
```
|
||
|
||
On the local WSL checkout use `YUVOMI_BUILD_DIR=/home/neste/yuvomi-native-build`
|
||
and the SDK paths from [continuation](continuation.md). Select only the authorized
|
||
test emulator with `ANDROID_SERIAL=emulator-5554`; unrelated/unauthorized attached
|
||
devices are not test targets.
|
||
|
||
## External gates
|
||
|
||
Broad Apple UI/runtime coverage, real supported devices, Android API 37, native
|
||
SSO/reset/invite protocols, permission/role cases, files/offline/notifications,
|
||
complete module and settings parity, visual baselines, accessibility and human
|
||
security review remain open. Missing modules are listed in
|
||
[native parity](native-parity.md), not silently represented as working.
|