CI: require clean Android smoke screenshots

.gitattributes

@@ -0,0 +1,3 @@
+# This legacy source is stored with CRLF line endings. Treat CR as part of the
+# line terminator so semantic changes can still pass Git's whitespace checks.
+mobile_agent/lib/core/evidence/action_runner.dart whitespace=cr-at-eol

.github/actionlint.yaml

@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - mobilecode-device-lab

.github/workflows/android-app-test.yml

@@ -15,6 +15,7 @@ on:
       - 'mobile_agent/**'
       - 'docs/mobilecode-accessibility-background-permissions-qa.md'
       - 'roadmap/tasks/T25-accessibility-background-permissions.md'
+      - 'scripts/run_android_app_smoke_ci.sh'
       - '.github/workflows/android-app-test.yml'
       - '.github/workflows/android-apk.yml'
 
@@ -55,7 +56,7 @@ jobs:
 
       - name: Analyze Flutter entry surfaces
         working-directory: mobile_agent
-        run: flutter analyze lib/main.dart lib/screens/home_screen.dart lib/screens/settings_screen.dart lib/screens/github_screen.dart lib/screens/github_repo_hub_screen.dart lib/screens/role_manager_screen.dart lib/screens/api_usage_screen.dart lib/screens/device_telemetry_screen.dart lib/services/github_deep_service.dart lib/services/github_oauth_flow.dart lib/services/role_library_service.dart lib/services/token_usage_service.dart lib/services/token_pricing_service.dart lib/services/device_telemetry_service.dart lib/services/mobile_code_helper_auth.dart lib/services/phone_use_accessibility_service.dart --no-fatal-infos --no-fatal-warnings
+        run: flutter analyze lib/main.dart lib/screens/home_screen.dart lib/screens/settings_screen.dart lib/screens/github_screen.dart lib/screens/github_repo_hub_screen.dart lib/screens/role_manager_screen.dart lib/screens/api_usage_screen.dart lib/screens/device_telemetry_screen.dart lib/services/github_deep_service.dart lib/services/github_oauth_flow.dart lib/services/role_library_service.dart lib/services/token_usage_service.dart lib/services/token_pricing_service.dart lib/services/device_telemetry_service.dart lib/services/mobile_code_helper_auth.dart lib/services/phone_use_accessibility_service.dart lib/services/model_provider_preset_service.dart lib/services/tuima_provider_service.dart test/services/model_provider_preset_service_test.dart test/services/tuima_provider_service_test.dart --no-fatal-infos --no-fatal-warnings
 
       - name: Build debug APK for emulator
         working-directory: mobile_agent
@@ -72,29 +73,9 @@ jobs:
           profile: pixel_2
           target: default
           disable-animations: true
-          script: |
-            set -eux
-            mkdir -p artifacts
-            adb wait-for-device
-            adb shell settings put global hide_error_dialogs 1 || true
-            installed=0; for attempt in 1 2 3; do if timeout 120s adb install -r mobile_agent/build/app/outputs/flutter-apk/app-pure-debug.apk; then installed=1; break; fi; adb kill-server; adb start-server; adb wait-for-device; sleep 20; done; test "$installed" = 1
-            adb shell am force-stop com.mobilecode.app
-            adb forward --remove tcp:18765 || true
-            adb forward tcp:18765 tcp:8765
-            helper_ready=0; for attempt in $(seq 1 12); do timeout 5s adb shell am start -n com.mobilecode.app/.MobileCodeHelperLauncherActivity --es mobilecode_helper_auth_token ci-helper-token > artifacts/helper-launch.txt 2>&1 || true; if curl --connect-timeout 2 --max-time 5 -fsS -H 'X-MobileCode-Token: ci-helper-token' http://127.0.0.1:18765/v1/health > artifacts/android-helper-health.json; then helper_ready=1; break; fi; sleep 1; done; if [ "$helper_ready" != 1 ]; then adb shell dumpsys activity services com.mobilecode.app > artifacts/helper-services.txt || true; adb logcat -d -t 1500 > artifacts/android-logcat.txt || true; cat artifacts/helper-launch.txt || true; grep -E 'MobileCodeHelper|AndroidRuntime' artifacts/android-logcat.txt | tail -n 200 || true; exit 1; fi
-            curl -fsS -H 'X-MobileCode-Token: ci-helper-token' http://127.0.0.1:18765/v1/health | tee artifacts/android-helper-health.json
-            test "$(curl -sS -o /dev/null -w '%{http_code}' -H 'X-MobileCode-Token: wrong-token' http://127.0.0.1:18765/v1/health)" = 401
-            curl -fsS -H 'X-MobileCode-Token: ci-helper-token' -H 'Content-Type: application/json' -X POST http://127.0.0.1:18765/v1/execute -d '{"command":"pwd","timeoutMs":10000}' | tee artifacts/android-helper-execute.json
-            curl -fsS -H 'X-MobileCode-Token: ci-helper-token' http://127.0.0.1:18765/v1/tasks/current | tee artifacts/android-helper-task.json
-            grep '"name":"MobileCode Helper Service"' artifacts/android-helper-health.json
-            grep '"ready":true' artifacts/android-helper-health.json
-            grep '"authRequired":true' artifacts/android-helper-health.json
-            grep '"backgroundService":true' artifacts/android-helper-health.json
-            grep '"exitCode":0' artifacts/android-helper-execute.json
-            grep '"failureKind":"none"' artifacts/android-helper-execute.json
-            adb logcat -c || true
-            timeout 30s adb shell am start -W -n com.mobilecode.app/.MainActivity | tee artifacts/main-start.txt
-            app_drawn=0; for attempt in $(seq 1 48); do adb shell pidof com.mobilecode.app; adb shell dumpsys window windows > artifacts/window-focus.txt || true; adb shell uiautomator dump /sdcard/mobilecode-window.xml >/dev/null 2>&1 || true; adb pull /sdcard/mobilecode-window.xml artifacts/window-hierarchy.xml >/dev/null 2>&1 || true; if awk '/Window #[0-9]+/ { in_app = ($0 ~ /com\.mobilecode\.app\/.*MainActivity/) } in_app && /Surface: shown=true/ { ok=1 } END { exit ok ? 0 : 1 }' artifacts/window-focus.txt || { grep -q 'package="com.mobilecode.app"' artifacts/window-hierarchy.xml 2>/dev/null && grep -q 'content-desc="MobileCode"' artifacts/window-hierarchy.xml 2>/dev/null; }; then app_drawn=1; break; fi; sleep 5; done; echo "$app_drawn" > artifacts/app-drawn.txt; if grep -q "System UI isn't responding" artifacts/window-hierarchy.xml 2>/dev/null; then adb shell input tap 540 1059 || true; sleep 2; adb shell uiautomator dump /sdcard/mobilecode-window.xml >/dev/null 2>&1 || true; adb pull /sdcard/mobilecode-window.xml artifacts/window-hierarchy.xml >/dev/null 2>&1 || true; fi; test -s artifacts/window-hierarchy.xml || exit 1; if grep -q "System UI isn't responding" artifacts/window-hierarchy.xml; then exit 1; fi; adb shell pidof com.mobilecode.app; adb exec-out screencap -p > artifacts/mobilecode-android-smoke.png || true; test -s artifacts/mobilecode-android-smoke.png || exit 1; adb logcat -d -t 2000 > artifacts/android-logcat.txt || true; grep -q "com.mobilecode.app" artifacts/window-focus.txt; grep -E "FATAL EXCEPTION|E AndroidRuntime|NoSuchMethodError|MissingPluginException|ANR in com.mobilecode.app" artifacts/android-logcat.txt && exit 1 || true; test "$app_drawn" = 1
+          # android-emulator-runner executes each script line in a separate shell.
+          # Keep stateful control flow in a checked-in POSIX shell script.
+          script: sh scripts/run_android_app_smoke_ci.sh
 
       - name: Upload Android smoke artifacts
         uses: actions/upload-artifact@v7

.github/workflows/device-agent-qa.yml

@@ -0,0 +1,166 @@
+name: External agent-device QA
+
+on:
+  workflow_dispatch:
+    inputs:
+      lane:
+        description: QA lane to run
+        required: true
+        type: choice
+        default: ios-simulator
+        options:
+          - ios-simulator
+          - physical-device-lab
+      platform:
+        description: Physical device platform (ignored by iOS simulator lane)
+        required: true
+        type: choice
+        default: android
+        options:
+          - android
+          - ios
+      app_id:
+        description: Installed package or bundle identifier
+        required: true
+        default: com.mobilecode.app
+      device:
+        description: Optional simulator name, Android serial, or iOS device selector
+        required: false
+        default: ''
+      approve_artifacts:
+        description: Explicitly approve non-sensitive visual artifacts
+        required: true
+        type: boolean
+        default: false
+      approve_video:
+        description: Explicitly approve iOS Simulator video (requires artifacts approval)
+        required: true
+        type: boolean
+        default: false
+      sensitive_flow:
+        description: Login/credential QA mode; forbids screenshots, video, and logs
+        required: true
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+env:
+  AGENT_DEVICE_VERSION: 0.19.3
+  AGENT_DEVICE_NO_UPDATE_NOTIFIER: '1'
+
+jobs:
+  ios-simulator:
+    if: ${{ inputs.lane == 'ios-simulator' }}
+    runs-on: macos-15
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Install pinned external device CLI
+        run: npm install --global "agent-device@${AGENT_DEVICE_VERSION}"
+
+      - uses: subosito/flutter-action@v2
+        with:
+          flutter-version: 3.44.1
+          channel: stable
+          cache: true
+
+      - name: Build unsigned simulator app
+        working-directory: mobile_agent
+        run: |
+          flutter pub get
+          (cd ios && pod install)
+          xcodebuild \
+            -workspace ios/Runner.xcworkspace \
+            -scheme Runner \
+            -configuration Debug \
+            -sdk iphonesimulator \
+            -destination 'generic/platform=iOS Simulator' \
+            -derivedDataPath build/ios/agent-device-derived \
+            CODE_SIGNING_ALLOWED=NO \
+            build
+
+      - name: Boot simulator
+        env:
+          QA_DEVICE: ${{ inputs.device }}
+        run: |
+          if [[ -n "$QA_DEVICE" ]]; then
+            agent-device boot --platform ios --device "$QA_DEVICE"
+          else
+            agent-device boot --platform ios
+          fi
+
+      - name: Run bounded MobileCode device QA
+        env:
+          QA_APPROVE_ARTIFACTS: ${{ inputs.approve_artifacts }}
+          QA_APPROVE_VIDEO: ${{ inputs.approve_video }}
+          QA_SENSITIVE_FLOW: ${{ inputs.sensitive_flow }}
+          QA_DEVICE: ${{ inputs.device }}
+        run: |
+          args=(
+            --platform ios
+            --app-id com.mobilecode.app
+            --app-binary mobile_agent/build/ios/agent-device-derived/Build/Products/Debug-iphonesimulator/Runner.app
+            --output .artifacts/agent-device-qa
+          )
+          if [[ -n "$QA_DEVICE" ]]; then args+=(--device "$QA_DEVICE"); fi
+          if [[ "$QA_APPROVE_ARTIFACTS" == 'true' ]]; then args+=(--approve-artifacts); fi
+          if [[ "$QA_APPROVE_VIDEO" == 'true' ]]; then args+=(--approve-video); fi
+          if [[ "$QA_SENSITIVE_FLOW" == 'true' ]]; then args+=(--sensitive-flow); fi
+          python3 scripts/run_agent_device_mobilecode_qa.py "${args[@]}"
+
+      - name: Upload reviewed local evidence
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: mobilecode-agent-device-ios-evidence
+          path: .artifacts/agent-device-qa
+          if-no-files-found: warn
+          retention-days: 7
+
+  physical-device-lab:
+    if: ${{ inputs.lane == 'physical-device-lab' }}
+    runs-on: [self-hosted, macOS, mobilecode-device-lab]
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Install pinned external device CLI
+        run: npm install --global "agent-device@${AGENT_DEVICE_VERSION}"
+
+      - name: Run against preinstalled physical-device app
+        env:
+          QA_PLATFORM: ${{ inputs.platform }}
+          QA_APP_ID: ${{ inputs.app_id }}
+          QA_DEVICE: ${{ inputs.device }}
+          QA_APPROVE_ARTIFACTS: ${{ inputs.approve_artifacts }}
+          QA_SENSITIVE_FLOW: ${{ inputs.sensitive_flow }}
+        run: |
+          args=(
+            --platform "$QA_PLATFORM"
+            --app-id "$QA_APP_ID"
+            --output .artifacts/agent-device-qa
+          )
+          if [[ -n "$QA_DEVICE" ]]; then args+=(--device "$QA_DEVICE"); fi
+          if [[ "$QA_APPROVE_ARTIFACTS" == 'true' ]]; then args+=(--approve-artifacts); fi
+          if [[ "$QA_SENSITIVE_FLOW" == 'true' ]]; then args+=(--sensitive-flow); fi
+          python3 scripts/run_agent_device_mobilecode_qa.py "${args[@]}"
+
+      - name: Upload reviewed local evidence
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: mobilecode-agent-device-physical-evidence
+          path: .artifacts/agent-device-qa
+          if-no-files-found: warn
+          retention-days: 7

.github/workflows/mobile-runtime-ci.yml

@@ -10,6 +10,9 @@ on:
       - 'docs/mobilecode-release-qa.md'
       - 'docs/mobilecode-accessibility-background-permissions-qa.md'
       - 'roadmap/tasks/T25-accessibility-background-permissions.md'
+      - 'docs/mobile-harness-benchmark/phone-use/**'
+      - 'docs/mobile-harness-benchmark/reports/phone-use-v1-readiness.*'
+      - 'scripts/validate_mobile_harness_phone_use_v1.py'
       - '.github/workflows/mobile-runtime-ci.yml'
   push:
     paths:
@@ -19,6 +22,9 @@ on:
       - 'docs/mobilecode-release-qa.md'
       - 'docs/mobilecode-accessibility-background-permissions-qa.md'
       - 'roadmap/tasks/T25-accessibility-background-permissions.md'
+      - 'docs/mobile-harness-benchmark/phone-use/**'
+      - 'docs/mobile-harness-benchmark/reports/phone-use-v1-readiness.*'
+      - 'scripts/validate_mobile_harness_phone_use_v1.py'
       - '.github/workflows/mobile-runtime-ci.yml'
 
 permissions:
@@ -29,6 +35,19 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  phone-use-eval-contract:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Validate controlled Phone Use v1 contract
+        run: |
+          python3 -m py_compile scripts/validate_mobile_harness_phone_use_v1.py
+          python3 scripts/validate_mobile_harness_phone_use_v1.py
+
   flutter-runtime-tests:
     runs-on: ubuntu-latest
     timeout-minutes: 25
@@ -163,7 +182,9 @@ jobs:
           grep -q 'mobile_coding/platform' mobile_agent/tooling/MainActivity.kt
           cmp -s mobile_agent/tooling/MobileCodeHelperService.kt mobile_agent/android/app/src/main/kotlin/com/mobilecode/app/MobileCodeHelperService.kt
           cmp -s mobile_agent/tooling/MobileCodeHelperLauncherActivity.kt mobile_agent/android/app/src/main/kotlin/com/mobilecode/app/MobileCodeHelperLauncherActivity.kt
+          cmp -s mobile_agent/tooling/MainActivity.kt mobile_agent/android/app/src/main/kotlin/com/mobilecode/app/MainActivity.kt
           cmp -s mobile_agent/tooling/PhoneUseAccessibilityService.kt mobile_agent/android/app/src/main/kotlin/com/mobilecode/app/PhoneUseAccessibilityService.kt
+          grep -q 'android:canTakeScreenshot="true"' mobile_agent/tooling/prepare_android_project.py
 
       - name: Smoke test helper protocol
         run: |
@@ -179,7 +200,7 @@ jobs:
           auth_header='X-MobileCode-Token: ci-token'
           trap 'kill "$helper_pid" || true' EXIT
 
-          for attempt in $(seq 1 20); do
+          for _ in $(seq 1 20); do
             if curl -fsS -H "$auth_header" http://127.0.0.1:18765/v1/health > artifacts/helper-health.json; then
               break
             fi