Files

T

slhx agent 2b9979e339 fix(workout): make mobile verification fail closed

Make workout mobile-verify reject non-HTTPS origins and release kits that omit detected external signing/toolchain blockers, so verification checks objective release preconditions instead of pretending to predict store approval.

req: examples/006

2026-06-12 12:31:19 +02:00

3.4 KiB

Raw Blame History

Recipe: Workout mobile release

The Workout exemplar is the production-shaped mobile path for hemx. It stays boring on purpose: hemx builds the server app and writes mobile shell metadata; Android/iOS SDKs, store signing, provisioning, and submission remain external vendor work. req: examples/006

Command surface

cargo run -p hemx-xtask -- workout dev
cargo run -p hemx-xtask -- workout test
cargo run -p hemx-xtask -- workout build
cargo run -p hemx-xtask -- workout mobile-release
cargo run -p hemx-xtask -- workout mobile-verify
cargo run -p hemx-xtask -- workout doctor

workout mobile-release builds target/release/hemx-workout-example and writes a release kit under target/hemx-mobile/workout by default:

target/hemx-mobile/workout/
  release-manifest.json
  BLOCKERS.md
  android/twa-release.json
  android/README.md
  ios/webview-release.json
  ios/README.md

Use workout mobile-verify to check the generated kit and release binary. It fails on a non-HTTPS production origin, missing/inconsistent Android or iOS metadata, or external toolchain/signing blockers that were not written into the manifest and BLOCKERS.md. Use workout doctor when you only want to see missing external inputs.

Production configuration

Set these explicitly for a real app release:

HEMX_WORKOUT_APP_ID=com.example.workout
HEMX_WORKOUT_APP_NAME="Workout Copilot"
HEMX_WORKOUT_VERSION=1.0.0
HEMX_WORKOUT_ORIGIN=https://workout.example.com
HEMX_WORKOUT_ANDROID_PACKAGE=com.example.workout
HEMX_WORKOUT_IOS_BUNDLE_ID=com.example.workout
HEMX_WORKOUT_MOBILE_OUT=target/hemx-mobile/workout

The generated manifest records:

app identity and version;
the production HTTPS origin used by Android and iOS shells;
target/release/hemx-workout-example as the server artifact;
runtime assets served by the same release through hemx_axum::runtime_js_path();
cache policy: release-scoped HTML/CSS/runtime assets only;
offline truth policy: app-owned command/event/projection records, never DOM patches or UI effect payloads;
host capability policy: Android and iOS shell metadata declare share/haptics and the same denied, timeout, unavailable, and error result kinds handled by app code before UI effects;
environment/secrets boundary: public shell config in the kit, signing secrets outside the repo;
rollback: redeploy the previous server binary and rebuild store artifacts from the previous shell metadata/signing inputs. req: local/001 req: host/002

Android and iOS artifacts

The command writes release-ready metadata, not store-signed binaries. That is the honest boundary: producing .aab/.apk and .ipa files requires vendor SDKs, signing credentials, and store accounts on the release machine.

Android blockers are reported when the Android SDK/JDK/signing key are not visible. iOS blockers are reported when Xcode or the Apple signing team is not visible. These blockers are copied into BLOCKERS.md so the release kit can be reviewed without guessing what is still external. req: examples/006

What this does not add

This is not a hemx-mobile framework, sync layer, client database, or native UI runtime. The mobile shells load the production Workout web app and route host capabilities such as share/haptics through the typed host boundary before UI effects are produced; denied, timeout, unavailable, and error cases share the same host result shape. req: host/002 req: local/002

3.4 KiB Raw Blame History