tmk241/hemx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(workout): gate mobile verification on product tests

Browse Source 
Make workout mobile-verify rerun the Workout product tests before release-kit checks so app value, recovery, local state, and host capability boundaries fail closed with mobile artifacts.

req: examples/001

req: examples/006

req: host/002

req: local/001
This commit is contained in:
slhx agent
2026-06-12 12:35:41 +02:00
parent 2b9979e339
commit d4e99b6e73
3 changed files with 27 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/recipes/mobile-release.md
+7 -5
View File
@@ -29,11 +29,13 @@ target/hemx-mobile/workout/
ios/README.md ios/README.md
``` ```
Use `workout mobile-verify` to check the generated kit and release binary. It Use `workout mobile-verify` as the store-readiness product gate: it runs the
fails on a non-HTTPS production origin, missing/inconsistent Android or iOS Workout product tests, then checks the generated kit and release binary. It
metadata, or external toolchain/signing blockers that were not written into the fails on broken app value/recovery/host-boundary tests, a non-HTTPS production
manifest and `BLOCKERS.md`. Use `workout doctor` when you only want to see origin, missing/inconsistent Android or iOS metadata, or external
missing external inputs. toolchain/signing blockers that were not written into the manifest and
`BLOCKERS.md`. Use `workout doctor` when you only want to see missing external
inputs.
## Production configuration ## Production configuration
examples/workout/README.md
+8 -5
View File
@@ -70,11 +70,14 @@ HEMX_WORKOUT_ORIGIN=https://workout.example.com \
``` ```
The kit lands in `target/hemx-mobile/workout` unless The kit lands in `target/hemx-mobile/workout` unless
`HEMX_WORKOUT_MOBILE_OUT` is set. It records app identity, version, production `HEMX_WORKOUT_MOBILE_OUT` is set. `workout mobile-verify` reruns the Workout
origin, runtime asset policy, cache/offline state policy, secrets/signing product tests before checking the release kit, so app value, recovery, local
boundaries, rollback expectations, Android TWA metadata, iOS WebView metadata, state, and host capability boundaries fail closed with the mobile artifacts. The
and any external blocker such as missing Android SDK, Xcode, or store signing kit records app identity, version, production origin, runtime asset policy,
credentials. See `docs/recipes/mobile-release.md`. req: examples/006 cache/offline state policy, secrets/signing boundaries, rollback expectations,
Android TWA metadata, iOS WebView metadata, and any external blocker such as
missing Android SDK, Xcode, or store signing credentials. See
`docs/recipes/mobile-release.md`. req: examples/006
## Boundaries proven ## Boundaries proven
hemx-xtask/src/main.rs
+12 -1
View File
@@ -127,7 +127,18 @@ fn run_workout_mobile_release() -> ExitCode {
} }
fn run_workout_mobile_verify() -> ExitCode { fn run_workout_mobile_verify() -> ExitCode {
// req: examples/006 // req: examples/001 req: examples/006 req: host/002 req: local/001
let budget = Budget::detect();
budget.report();
if let Err(code) = Step::new(
"workout-mobile-product-gate",
["test", "-p", "hemx-workout-example"],
)
.run(&budget)
{
return code;
}
let config = WorkoutMobileConfig::from_env(); let config = WorkoutMobileConfig::from_env();
let failures = verify_workout_mobile_release(&config, true); let failures = verify_workout_mobile_release(&config, true);
let blockers = mobile_external_blockers(&config); let blockers = mobile_external_blockers(&config);