10 Commits
Author SHA1 Message Date
james.maesandClaude Sonnet 5.5 089f57f759 Revert "ci: first run on ci-workflows v1 (native workflows)"
android / android (push) Failing after 3m29s
build / android (push) Failing after 3m29s
Commit 1d3847d deleted the entire tree (2584 files) and added nothing, so main was empty. This restores main to dc43a6a (the PR 22 merge) exactly.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-09 06:18:45 -06:00
James MaesandClaude Opus 5.5 1d3847d070 ci: first run on ci-workflows v1 (native workflows)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-08 08:26:19 -06:00
james.maesandCodex 1127e4e4fa test: isolate location permissions in scanner UI acceptance
Include diagnostics UI acceptance in the hosted suite. Pregrant location only for disposable E2E scenarios and preserve session-monitor denied telemetry with explicit revocation and a handled-request marker. Production and QA permissions are untouched; the actual Android prompt remains separate acceptance.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
2026-11-01 10:41:04 -06:00
james.maesandOpenAI GPT-6.1 d316567fdc feat: secure Zebra scanning and unify mobile Back routing
Use the optional device-provided EMDK service for normal scanner input,
with exact compile-only SDK provenance and no shipped vendor classes.
Keep synthetic scan broadcasts confined to the disposable E2E variant.
Pause input behind overlays and lost focus, and share live drawer-first
Back routing across every process/application handler and toolbar arrow.

Replace inherited Auth0/Coil prereleases with reviewed stable versions.
Invalidate standard generated notices on dependency graph changes and
retain strict runtime/license checks. Pin hosted acceptance to the
source-qualified API 1.9 core/server tuple with runtime provenance.

Validation: 127 JVM tests, 34 TC22 shared native cases, eight-overlay
native regression, and ordinary-UID/distinct-signer injection rejection
pass. Eight forged broadcasts cause no process/record mutation; a real
manual positive control saves through the API. All package/lint gates,
four-APK notice/DEX/native/manifest inspection, focused independent
source review, workflow syntax and staged secret checks pass.

Actual hardware triggers, configured provider, optional files deployment
and final signing/distribution remain separate documented release gates.
No normal operator installation or data was changed by these tests.

Co-Authored-By: OpenAI GPT-6.1 (Codex) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
2026-10-31 20:18:41 -05:00
james.maesandGPT-6.1 Codex d5b5580d60 feat: add mobile sessions, record photos and guarded navigation
Add semantic session monitoring and leased app-screen viewing, optional record
photo capture, device orientation, native navigation guards and TC22 acceptance.
Bundle verified dependency and native notices with fail-closed packaging checks.

Co-Authored-By: GPT-6.1 Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
2026-10-31 07:21:38 -05:00
james.maesandOpenAI GPT-6 6574ec4991 fix: enforce semantic UI API contracts in scanner host
Discover compatible API versions, client channels and mobile extensions before login. Follow server process completion, metadata updates, form rules and cancellation, with isolated native OpenAPI conformance coverage.

Co-Authored-By: OpenAI GPT-6 (Codex) <noreply@openai.com>
2026-10-30 18:30:01 -05:00
james.maesandOpenAI GPT-6 13391d210e test: cover scanner workflow against the real QQQ server
Co-Authored-By: OpenAI GPT-6 (Codex) <noreply@openai.com>
2026-10-30 16:42:04 -05:00
james.maesandOpenAI GPT-6 e53e503871 fix: avoid false offline blocking in scanner host
Co-Authored-By: OpenAI GPT-6 (Codex) <noreply@openai.com>
2026-10-30 09:07:03 -05:00
james.maes b7c58f891a docs: record emulator acceptance and local restart steps 2026-10-29 15:43:50 -05:00
james.maes dfdbb74d21 feat: add native scanner host and Android verification workflows 2026-10-29 14:16:19 -05:00