Skip to content
sysout.dev

Android delivery

Version 0.3 / code 3 has passed local release preparation against the published libraries; see the registry adoption status for the locally validated review branches, publication handoff and remaining gates.

Release scope and baseline

Version 0.3 / code 3 carries forward the released 0.2 features and adds About/build metadata, separate debug identity, refreshed artwork, and shared delivery adoption. On October 22, 2026 the owner confirmed that 0.2 is released and code 2 is the highest uploaded Play code. The source baseline for a rebuilt upgrade test is the 0.2 preparation checkpoint aa48689. A rebuilt baseline is not a downloaded Play artifact; local upgrade testing signs both APKs with the same upload key.

Shared ownership

All four include-only adapters use shared commit abe74c44d3e79fbc1ef709d3ea5c3c89cb05ce5e94d5cfeedebb212a5dac45c5, extending the stable v0.1.0 implementation with JDK provisioning, standard Gradle library publication, optional combined verification and the Android container/SDK setup fix in shared MR 4. Shared MR 3 is merged; merge shared MR 4 without squashing before merging this app, preserving the full commit pin on main. The same SHA is recorded as template_revision. The owner reports tag protection is unavailable for this account; the full commit pin prevents changes to the unprotected shared tag from changing this consumer’s templates.

Generic job definitions, guards, signing, publication, listing, failure handling, and persisted-listing verification belong in sysout-gitlab-ci. This app owns version fields, canonical notes, code-keyed Play notes, listing text, artwork, the data-only manifest, package identity, and signing/Play configuration. Do not add local publishing jobs, script overrides, or Fastfiles.

SAST and secret-detection includes and stages are retained. verify-combined.yml runs lint, unit tests and debug assembly together in one job to conserve minutes. Only the guarded listing-only workflow sets GitLab’s SAST_DISABLED and SECRET_DETECTION_DISABLED flags, avoiding unrelated scans for a metadata sync. Normal branch, merge-request and release workflows retain the security scans. There are no app-owned job/script overrides.

Library consumption

The Sysout library groups resolve exclusively from the standalone Sysout Platform project’s Maven registry. Release coordinates are meal-domain/data/catalog 0.4.0 and so-compose 0.1.0. CI uses CI_JOB_TOKEN; local private-registry builds can use the user Gradle property gitLabPrivateToken, including through the environment variable ORG_GRADLE_PROJECT_gitLabPrivateToken. Never commit or print its value.

For local consumer integration only, -PsysoutMavenRepository=file:///absolute/path can select an isolated Maven Local publication directory. -Pci rejects that override. No local Maven fallback is configured. The final live consumer check must use the published GitLab endpoint after the registry set and consumer allowlist are ready.

Preparation and validation

  1. Recheck the branch, worktree, remote main, existing tags, and live GitLab pipeline status. Preserve unrelated work and prior artifacts.

  2. Confirm the shipped baseline and highest uploaded Play code. Prepare an unused, increasing code with matching versionName, release page, navigation, and fastlane/metadata/android/en-US/changelogs/<code>.txt (1 to 500 characters).

  3. Confirm protected main, CI job-token Git pushes, the app’s Secure File upload keystore, protected/masked signing variables, and protected Play integration. The owner confirmed signing/Secure File/Play prerequisites on October 22, 2026. Independent inspection of that configuration was unavailable. The latest project API confirms job-token pushes are enabled. Recheck remaining package-read access before the GitLab consumer verification.

  4. Configure Internal and closed Alpha and the service account’s app-specific testing-release and store-presence permissions. Neither mode needs production access.

  5. Run :androidApp:verifyReleaseTag -PreleaseTag=v0.3, :androidApp:testDebugUnitTest, :shared:testAndroidHostTest, :androidApp:lintDebug, :androidApp:assembleDebug, :androidApp:assembleRelease, and :androidApp:bundleRelease. This project’s task graph does not expose :androidApp:testReleaseUnitTest.

  6. Verify APK/AAB signatures, package/version, non-debuggable release flags, and signing-certificate continuity. Record artifact checksums.

  7. Before the preparation commit, install and launch the fresh signed release on an isolated local AVD. Also install the rebuilt signed 0.2 baseline, create test data, upgrade with adb install -r, and verify data and preferences survive launch and process recreation. Check Home, profiles, feeding history, planner, recipes, Settings/theme, and About. Record AVD/API/package/version/results.

  8. Validate metadata limits, manifest paths/order, artwork, all four shared inputs, and release/listing workflow guards. Commit and push only after local signed release and upgrade checks pass. Inspect the fresh GitLab verification pipeline.

Evidence is retained locally in artifacts/validation/2026-10-22-release-candidate/ and artifacts/validation/2026-10-23-registry-adoption/. See the validation report there for actual results and remaining boundaries.

October 23 local candidate results

The signed staging candidate passed fresh installation, onboarding, process recreation and a data-preserving upgrade from source-rebuilt signed 0.2 on LittleBloomers_API_36 / emulator-5558 (API 36). Child name/date, saved recipe, today’s meal plan, fed check-in, history/note and Garden Glow preference survived. About reports 0.3/build 3; the installed release APK matches the verified artifact and is not debuggable. Recipe header collapse/expand and planner Today focus pass. The owner approved the current Homey header on October 23; Recipe Details' Ingredients collapse/expand check satisfies that focused adoption check. Six actual listing screenshots and all metadata limits/paths pass local checks. The debug package installs alongside the release, starts separate onboarding and leaves the release data intact. All four bundled 64-bit native libraries pass 16 KB ELF LOAD-alignment checks; all six native binaries match between APK and AAB, and the APK passes zipalign -c -P 16 4. This is static packaging validation; the smoke AVD uses 4 KB pages.

Candidate APK SHA-256: eb65e6bd9b9062d24c9b4587c399ad169fcbd36bf425e0a34b0ce8025b635522. Candidate AAB SHA-256: 583de78ef60c9b7f8465f6ed77a612a7abd93dca955622264228656826ff2ef2. Both signatures verify; baseline and candidate share certificate SHA-256 e2d2ffa8eac7e9663ab56c4b4e8a13134c78b48399fbb3ce612bce116bd4ae67.

The earlier builds above consumed isolated staged library publications and retained public Gradle caches. Those results alone did not prove live registry access or a Linux runner. The registry-backed validation below supersedes the earlier local-library gate; this app’s own fresh GitLab verification remains part of the push handoff.

Registry-backed candidate

The final local build resolved all four library publications from project 87989353 using the normal private GitLab Maven endpoint. The build refreshed dependency metadata and passed the version-tag guard, five app/shared tests, debug assembly, signed release APK and signed AAB generation in 7m 43s. Debug lint reports zero errors and 53 dependency/style/resource warnings; no dependency upgrades or unrelated warning cleanup are included in this release.

Before the preparation commit, the signed candidate passed a data-preserving 0.2-to-0.3 upgrade and restart on the separate LittleBloomers_Release03_API_36 AVD / emulator-5558 (API 36, 1080 x 1920, 4 KB pages). Child details, the saved recipe, today’s breakfast, fed status, feeding history/note and Garden Glow selection survived. Profile, planner Today focus and Recipe Details' current Homey header collapse/expand passed. A subsequent clean signed installation passed newborn onboarding, About 0.3/build 3 and restart persistence. The registry-backed debug APK also installs separately, starts isolated onboarding and leaves the release profile intact; the temporary debug installation is removed.

Both signatures verify and retain the baseline certificate above. The installed APK checksum is checked against the signed file. Static 16 KB ELF/ZIP packaging checks pass again; this is not a 16 KB-page runtime test.

Final APK SHA-256: 7a6bacc789e26264f0f1d95d81e2557685de22a10b292c992405aaf46772ae06. Final AAB SHA-256: e5cadde2e6ffa9073fa5d7add0961bc2acdc217211731f34ba2a9242ed0c0919. Detailed logs, signatures, screenshots and summaries are retained in artifacts/validation/2026-10-23-live-registry/. Public Gradle caches were retained; the logs record actual downloads of Sysout metadata from the new registry. Inspect the fresh GitLab verification pipeline after the preparation push to establish this app’s own CI job-token access and Linux runner result.

Merge and publication handoff

The owner handles merge and publication. Preparation creates no app release tag and performs no Play upload or listing sync.

The first GitLab verification stopped before Gradle because the pinned image’s non-root user could not modify the runner checkout. Shared CI now selects Docker UID 0 and provisions missing declared SDK packages with standard sdkmanager. The app supplies Build Tools 36.1.0, matching local validation. This follow-up changes only CI inputs/documentation; signed app artifacts and runtime checks above remain unchanged. A new pipeline is required because old jobs retain old includes.

  1. Merge the reviewed preparation branch to protected main after verification.

  2. Start a new web pipeline on main with PIPELINE_ACTION=release and RELEASE_TAG=v0.3. After verification, approve create_release_tag. The same pipeline creates the tag, builds the signed bundle, and sends that bundle and code-3 notes to Internal and closed Alpha in one edit.

  3. For listing updates, independently start a new web pipeline on main with PIPELINE_ACTION=listing and empty RELEASE_TAG, then approve sync_play_listing. Require the fresh-edit persisted text and ordered-image verification result. The manifest manages the icon and phone screenshots; undeclared image types, including the existing feature graphic, are preserved.

Retrying an old job retains its old pipeline snapshot. Start new pipelines after merge. A local build or CI verification success does not establish Play acceptance, review completion, or public-store propagation.