Files

T

slhx agent 5a42f2664a feat(workout): verify mobile release kit

Add a workout-mobile verify command that checks the generated release kit and server artifact, then document it beside release/doctor so the mobile path has a recurring gate.

req: examples/006

2026-06-12 11:12:18 +02:00

2.8 KiB

Raw Blame History

Recipe: Workout mobile release

The Workout exemplar is the production-shaped mobile path for hemx. It stays boring on purpose: hemx builds the server app and writes mobile shell metadata; Android/iOS SDKs, store signing, provisioning, and submission remain external vendor work. req: examples/006

Command surface

cargo run -p hemx-xtask -- workout-mobile release
cargo run -p hemx-xtask -- workout-mobile verify
cargo run -p hemx-xtask -- workout-mobile doctor

release builds target/release/hemx-workout-example and writes a release kit under target/hemx-mobile/workout by default:

target/hemx-mobile/workout/
  release-manifest.json
  BLOCKERS.md
  android/twa-release.json
  android/README.md
  ios/webview-release.json
  ios/README.md

Use verify to check the generated kit and release binary. Use doctor when you only want to see missing external inputs.

Production configuration

Set these explicitly for a real app release:

HEMX_WORKOUT_APP_ID=com.example.workout
HEMX_WORKOUT_APP_NAME="Workout Copilot"
HEMX_WORKOUT_VERSION=1.0.0
HEMX_WORKOUT_ORIGIN=https://workout.example.com
HEMX_WORKOUT_ANDROID_PACKAGE=com.example.workout
HEMX_WORKOUT_IOS_BUNDLE_ID=com.example.workout
HEMX_WORKOUT_MOBILE_OUT=target/hemx-mobile/workout

The generated manifest records:

app identity and version;
the production HTTPS origin used by Android and iOS shells;
target/release/hemx-workout-example as the server artifact;
runtime assets served by the same release through hemx_axum::runtime_js_path();
cache policy: release-scoped HTML/CSS/runtime assets only;
offline truth policy: app-owned command/event/projection records, never DOM patches or UI effect payloads;
environment/secrets boundary: public shell config in the kit, signing secrets outside the repo;
rollback: redeploy the previous server binary and rebuild store artifacts from the previous shell metadata/signing inputs. req: local/001 req: host/002

Android and iOS artifacts

The command writes release-ready metadata, not store-signed binaries. That is the honest boundary: producing .aab/.apk and .ipa files requires vendor SDKs, signing credentials, and store accounts on the release machine.

Android blockers are reported when the Android SDK/JDK/signing key are not visible. iOS blockers are reported when Xcode or the Apple signing team is not visible. These blockers are copied into BLOCKERS.md so the release kit can be reviewed without guessing what is still external. req: examples/006

What this does not add

This is not a hemx-mobile framework, sync layer, client database, or native UI runtime. The mobile shells load the production Workout web app and route host capabilities such as share/haptics through the typed host boundary before UI effects are produced. req: host/002 req: local/002

2.8 KiB Raw Blame History