Skip to content

docs: record v0.1.78 iOS build evidence #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Harzva merged 1 commit into from
Aug 7, 2026
Merged

docs: record v0.1.78 iOS build evidence #43

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -421,6 +421,7 @@ See:

- [MobileCore dual-app evidence](docs/mobilecore-dual-app-qa.md) - 30 real offline cross-app requests, buffered/SSE parity, unload/reload, background continuity, low-memory notification, and process restart recovery passed on Android emulator.
- [Release assets](https://github.com/Harzva/mobilecode/releases/tag/v0.1.78) - the final signed Android `pure` APK is 33,073,027 bytes with SHA-256 `5123f48f93161838b166259061857b058ab63429051544e4ac0234088a886073`; the downloaded asset reports `0.1.78+68`, matches the MobileCode release certificate, contains no recognizable credential or concrete private-host-path value, and clean-launches with MobileCore ready on the Android 16 ARM64 emulator.
- [iOS Simulator](https://github.com/Harzva/mobilecode/actions/runs/31135405199) and [unsigned archive](https://github.com/Harzva/mobilecode/actions/runs/31135408249) - `0.1.78+68` now passes generated-project verification, simulator build/install/launch survival and crash-log checks, plus unsigned device archive packaging. These private workflow artifacts are build evidence, not signed physical-iPhone acceptance.
- [Signed Android v0.1.77 workflow](https://github.com/Harzva/mobilecode/actions/runs/31128587598) - the downloaded official `0.1.77+67` APK has SHA-256 `f008ede0e0305c835c3bf45bcc56f22c4fc911d0ae10b513f298d1bdfb0a1c1d`, verifies with the MobileCode release certificate, contains zero recognizable key/JWT/Bearer or private-host-path patterns, and clean-launches on the Android 16 ARM64 emulator.
- v0.1.77 makes the public release workflows fail closed if they reference or compile raw provider keys, relay bearer tokens, or an OAuth client secret. Public relay URLs, OAuth client IDs, and redirect URIs remain allowed configuration; users may still save their own provider key through the app's secure-storage flow.
- MobileCore `0.1.4-rc6` closes the emulator foreground-service regression. A 40-poll Android 16 lane kept MobileCode resumed while MobileCore retained its real local model and foreground service with zero failed health polls, freezes, FGS timeouts, ANRs, OOMs, or SIGABRTs. Android `background_restricted` is now a typed fail-closed routing state, not a hidden timeout.
Expand Down
2 changes: 2 additions & 0 deletions docs/releases/v0.1.78.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@ Release type: local-model linkage and Android background-safety pre-release patc
- APK Signature Scheme v2 verifies with certificate subject `CN=MobileCode, OU=MobileCode, O=Harzva, L=Shanghai, ST=Shanghai, C=CN` and certificate SHA-256 `35a6eee3e2d81d4c6b5d426984d1b04d7d5ffc3eae7707c6225f5decd80fa2da`.
- Post-download AOT scanning found zero recognizable GitHub-token, provider-key, bearer-token, JWT, or concrete private-host-path values.
- A clean Android 16 ARM64 emulator install reported `0.1.78+68`; the final asset then cold-launched in 479 ms with controlled permissions, rendered `v0.1.78` and `TuiMa 就绪`, and produced no fatal exception, ANR, OOM, or SIGABRT marker. MobileCore remained a foreground protocol-v2 service with the real local Qwen2.5 model ready.
- [iOS Simulator workflow 31135405199](https://github.com/Harzva/mobilecode/actions/runs/31135405199) rebuilt the generated iOS project, verified `0.1.78+68` plus top-level microphone and speech-recognition usage descriptions, built the simulator app, installed it, kept the same process alive through the smoke interval, rejected known privacy/crash signatures, and retained the screenshot and Runner log as private workflow artifacts.
- [Unsigned iOS archive workflow 31135408249](https://github.com/Harzva/mobilecode/actions/runs/31135408249) built and packaged the `0.1.78+68` device `.xcarchive` successfully. Both iOS runs used `upload_to_release=false`; simulator and unsigned-archive evidence do not replace signed physical-iPhone acceptance.

## Remaining gates

Expand Down