Repository navigation
Conversation
Enable the release branch test trigger and repair the inert recovery provenance fixture exposed by that run. No production app code changes.
(cherry picked from commit f225c19)
Codex local validationState: BLOCKED Current iOS results — 17 October 2026Actual current 2.6.4/620 Debug simulator artifact installed and launched on one NEW blank disposable iPhone17Pro/iOS26.4. Preserved source/owner simulators, wallets and all earlier evidence. Actual native 12-word Recovery Key entry reached Protected backup recovered. Native provenance was restored/protected and matched the selected original account before Continue. Real native crypto/canonical comparison exactly matched the backed-up wallet, both signers, saved label, empty vault map and account metadata; no backed-up record was missing or different. Whole current-image equality did NOT pass: the restored app has two local-only NodeConnect records while the source snapshot has none. Native production comparison is Actual cold process restart, complete PIN entry/Proceed, Testnet Home and recovered wallet/visible Mobile Key succeeded. A synchronous read of actual native MMKV BEFORE any new post-cold status request confirmed canonical/live consent FALSE, persistence metadata and correct selected account. Complete local recovery fingerprint and all collection counts were identical before/after the cold launch. Actual UI truthfully showed the difference banner and then Automatic backup is off / copies not deleted. Hardware catalog and Portal introduction rendered; NFC/device interaction was NOT RUN. The recovered disposable backend recorded exactly3 signed snapshots/HTTP200, zero enrollment, zero mutation and zero legacy read across recovery plus status checks. No hosted traffic, paid providers or transactions. Delete remains NOT RUN and LAST after both platform restore evidence. Environment recovery and Android limitThe Mac restarted at03:15UTC, ending prior test processes. Existing credential-free Mongo container/volume and original fixture DB were recovered unchanged. A separately reviewed insert-only transaction copied all original raw BSON into a NEW owned fixture DB; original and destination hashes matched after commit. The original DB and an unused intermediate copy are retained. Literal loopback64244 is served again, with actual current Android/iOS config and unchanged readiness gates/public contributor manifest. The retained strict16KB Android VM failed to finish OS boot after the Mac restart: repeated device online/offline, empty sys.boot_completed and unavailable activity service. Keeper was not launched and recovery was not attempted in that runtime. Only the owned VM was stopped; source user0 and newly created blank user10 remain intact. This is an OS/runtime blocker, not a diagnosed app failure. Existing exact-be89 Android positive producer/crypto/account/cold/consent results and the lost-response no-second-request failure from prior report6224892021 remain unchanged. Evidence retained locally
Private artifacts/keys/ciphertext/logs remain local; none uploaded. Failed initial helper bindings, asynchronous Promise-reader behavior and lazy-module results are retained separately; they are not app failures or passes. The reviewed bounded QA postback transport completed once and deleted only its own terminal slot. Open issues / next actionRequired IOS/ANDROID remain incomplete. Pending: Android clean protected and explicit older-copy restores; actual normal4KB runtime; iOS explicit older-copy and remaining positive/consent/account/fault acceptance; scoped Delete confirmed/uncertain/tombstone/recreate after restores; original-order zero-node bootstrap/reconnect no-op; native consent ordering/read errors/confirmed absence/legacy fallback persistence and remaining representative stale/CAS/partial-fanout/final-readback/recovery-supersession safety cases. The exact iOS whole-image difference above and the prior lost-response extra-request condition remain explicit, not waived. Previously owner-parked C8/navigation, stress/repeated variants and exhaustive cross-products remain parked; no new fix/rebuild campaign. Real devices/signers: NOT RUN. A fresh exact-SHA owner physical-only scope record is still required; old decisions are not reused. No IOS/ANDROID waiver or LOCAL_PASSED. Release readiness: NOT READY. Current source/security/human review, public-v2 integration failure, production backend operational/old-writer/rollback readiness, hosted activation, fresh store/config/counter and final artifact/channel approvals remain separate open gates. Hosted gates FALSE. No merge, production/index/data/admin/config write, deployment, release signing/AAB/splits, upload/submission/publication or transaction. Independent of Reproducibility and Bitkey. |
Codex local scope decisionState: OWNER_DEFERRED_PHYSICAL Only unrun physical checks are deferred. IOS and ANDROID simulator/emulator checks, known critical failures, independent review and the separate backend, configuration, signing and publication approvals remain required. No physical pass, LOCAL_PASSED or release authorization is asserted here. |
Codex local validation checkpointState: BLOCKED Checkpoint recorded 19 October 2026. Root rechecked live PR #7045 unchanged, draft/unmerged. This cumulative report reuses valid exact-source results and supersedes only outdated checkpoint descriptions, preserving all prior failures and evidence. It does not claim LOCAL_PASSED or release readiness. Results preserved on this source
New Android progress not covered by the previous public local report17 October normal4KB API36/ARM64 primary-user0 fixture booted, installed/launched the retained current APK, and completed new PIN/onboarding. Initial automation/input failures were retained; later actual UI entry verified all12 fields and tapped Next. The UI showed “Could not check protected backup”; the fixture request count was unchanged and actual adb reverse listing was empty. Reverse8081/64244 was restored, then ordinary Next was retried at07:17UTC. Its resulting restore outcome was not captured. Do not call that retry PASS, or classify this transport interruption as an app recovery defect. Existing app/account/form/device data remain preserved. 19 October host reboot invalidated old PIDs/sessions. Existing Mongo was resumed; read-only raw-BSON manifests of original57581, intermediate3978 and lastactive4734 all matched retained generation13/epoch0/not-deleted state. An insert-only snapshot transaction copied that same state into NEW fixture12510, with original unchanged/postcommit equality; port64244 was activated only after the verified receipt. Copying data is fixture setup, not native recovery acceptance. The existing normal4KB fixture resume attempt then recorded BLOCKED and stopped only owned PID13090 with verified SIGTERM. Its diagnostic nevertheless shows sys.boot_completed=1, zygote running and activity/package services present; Keeper was not launched. The exception message is empty. This attempt therefore needs helper/readiness-assertion diagnosis; it is not evidence of an Android boot failure or app crash. No automatic retry, wipe, source fix or rebuild occurred. Earlier strict16KB reboot failure remains a separate retained OS/runtime finding. Missing owner-approved release-essential acceptance
C8/navigation, stress, repeated cooldown/import variants and exhaustive negative cross-products remain parked. No new test scope or waiver is introduced. Review/access/release blockers, separate from native executionCurrent-head independent review and unresolved recorded CI/security disposition remain gates. Last recorded public-v2 Realm/Relay lane failed while the private-v3 proof passed; changing contributor pins/readiness to mask it is not allowed. CodeQL analysis execution is distinct from the failed aggregate/High alert disposition. Live head and all86 comments were rechecked19Oct; no newer source handoff or native report was found. Full check/review refresh remains required for a final release decision. Production backend operational/fleet/old-writer/rollback evidence and separately reviewed hosted activation remain open; gates are FALSE. Fresh authenticated store histories/counters/config, final production artifacts and channel approvals are separate work. Current artifacts are debug/simulator tests, not signed release artifacts. Preservation and capacityMandatory19Oct11:07UTC assessment: actual32.980244GiB available versus unchanged29.5GiB remaining-batch estimate including20GiB reserve, conditional margin3.480244GiB. Helper exit2 on the known protected embedded-worktree fingerprint limitation, helperfitNULL; five source guards match. No cleanup/new-fixture admission or guaranteed-fit claim. The19Oct resume guard minimum was34204864512bytes, above reserve. Refresh assessment before another new fixture/heavy operation. All fixtures, accounts, VMs, databases, source/dirty work, artifacts and private evidence are retained. No private logs/keys/ciphertext transferred. No merge, readiness/pin/gate changes, production writes/deployment, release signing, upload/submission/publication or real transactions. R4 remains independent of Reproducibility and Bitkey Wallet. Mac screen controls are available on19Oct. Existing owner simulator was observed only; no owner app/device action was taken. Root is diagnosing the off-checkout harness before any further owned Android resume. This checkpoint does not interrupt an active app test. |
Owner-directed reduced local test scope — 19 October 2026State: BLOCKED The release owner explicitly selected “Defer older-copy recovery tests”, then instructed: “The delete check also and do only one representative safety check.” For the remaining local batch:
Explicit older-copy recovery tests, protected Delete/tombstone/recreate tests, original-order bootstrap/reconnect proof and additional native safety permutations remain NOT RUN/incomplete and owner-deferred from this reduced execution batch. No feature is disabled by this test-scope choice. Existing C8/navigation/stress parking and physical-only decision6231002359 remain unchanged. This records owner instructions, not full IOS/ANDROID acceptance or LOCAL_PASSED. The original full required matrix is incomplete. Known failures, CI/security/review/backend and all readiness/pin/config/signing/publication gates remain unchanged. No merge, production change, release signing, private-data transfer, upload or publication. Android resumption blocker is now diagnosed: API36 dumpsys uses appId=10213 while the off-checkout harness expected userId=10213. Independent package UID10213, current user0, installed APK bytes/version and actual4096/API36/ARM64 boot all matched. Correcting only this QA parser requires no app source change or rebuild. Normal recovery outcome is still unproved. |
Codex local validation — reduced batch result, 19 October 2026State: LOCAL_FAILED The live PR head was rechecked against the expected full SHA. Existing current-source passes are reused; previous failures remain recorded. This supersedes checkpoint6265941220 for today's Android outcome and applies the owner's reduced execution scope6266011374. It does not claim LOCAL_PASSED, full platform acceptance or release readiness. Actual results
Diagnosis and preservationThe ANR main stack is in ART pread/ReadFullyAtOffset, ZIP extraction and DexFileLoader/openDex during application startup, before an initialized Keeper JS recovery runtime was observed. The underlying latency/cause is not uniquely proved; no wallet-code defect or critical data loss is inferred. Guest /data was25% used with4,482,996KiB available, and MemAvailable834,036KiB. Host swap was previously2,364MiB. Disk-full is not supported by the measured guest state. The old strict16KB reboot failure is separate from this successful normal4KB OS boot and subsequent app ANR. Current disposable fixture12510 recorded ZERO requests and ZERO commits throughout today's native attempt. All original/intermediate DBs57581/3978/4734 remain intact. Reviewed insert-only copy closure and fresh current12510 snapshot projection were genuine reads/setup, not native authenticated-HTTP acceptance. No legacy recovery or Delete was run. After Android had already killed the app, root verified no Keeper PID, exact ownership/start of VM17053, guest sync, and a graceful stop of that VM only. Its app data/accounts/PIN/AVD remain retained. Owner simulator6350 and every earlier fixture/account/evidence set were preserved. Task-owned Metro12375 and fixture12510/Mongo remain available; no database drop/reset/cleanup. Evidence retained locallyPrivate evidence directory: protected-native-be89/resume-essential-20261019/. No private key/PIN/ciphertext/log contents uploaded.
Scope and remaining gatesOwner explicitly deferred older-copy recovery, Delete/tombstone/recreate and further native safety/matrix execution; these remain NOT RUN/incomplete. C8/navigation/stress remain parked. No feature/gate was disabled or tests reported passed by deferral. The original full required matrix remains incomplete. The reduced batch itself remains blocked by the Android startup failure and unproved restore/cold verification. Current-head human review, recorded public-v2 integration failure, CodeQL High disposition, backend operational/old-writer/rollback evidence, hosted readiness and store/config/counter/final-artifact/channel approvals remain separate open gates. Hosted readiness stays FALSE. No merge, production/index/admin/config/data change, deploy, release signing, AAB/split construction, private-data transfer, upload/submission/publication or real transaction. R4 remains independent of Reproducibility and Bitkey Wallet. Next proposed stage is a bounded Android test-runtime diagnosis using the same installed APK, before any app source change, followed only by the still-unproved normal restore/cold check. This report does not start another repair/rebuild cycle or promise a completion time. Fresh checks and closeout capacity19Oct GitHub refresh returned10 check runs:5 success,4 failure (including2 local-gate jobs),1 cancelled. The public Realm/Relay lane actually reported295 tests /2PASS /293FAIL /0skip after genuine native/Mongo setup; it ran syntheticmergef72243c012ba6e3cad56d4a27b1179d1b5adbd18 with public838. Private-v3 genuine43/43 remains separate; no293-independent-defects claim or pin workaround. Public matrix. CodeQL aggregate still fails1High; numeric-only consumer evidence supports review, not a security PASS. Fresh formal alert metadata was unavailable through the connector. No human approval on exactbe89; the old d59 approval does not transfer. Mandatory closeout11:32:36UTC: actual23.854172GiB free versus23.5GiB remaining forecast including20GiB reserve; margin only0.354172GiB, below30GiB advisory threshold. All five source/status guards matched. Actual helper exit2 on the known protected embedded-worktree fingerprint limitation, helperfitNULL; manual arithmetic only, no helperPASS/new heavy-operation admission. Guard minimum23.873623GiB, reserve not breached. All caches/source/evidence/fixture/account/VM/volume state preserved; no cleanup. ContextSHA154d5a16f607a7a79d8e0f4777e4094ade2c749cf37c2e172d3a7f18a573a446; receiptSHAc7b8ca91bcf92113a7dff7ef482f317306c7f5cc990cae8762ef6136628c441a. Refresh before any proposed runtime repair/retry. Final actual fixture status id5 remained0requests/0commits, no armed faults/holds. Its complete tool-result receipt is retained locally as FIXTURE_FINAL_STATUS_ACTUAL_TOOL_RESULT.json. No further native execution is running. |
Codex local validationState: BLOCKED The requested normal Android protected Recovery Key restore and actual restart now passed their recorded subset. This completes that previously blocked case without changing source or APK. No LOCAL_PASSED/full-matrix/release-ready claim.
The initial broad cold-state reader returned INITIALIZED_NATIVE_READ_UNAVAILABLE while backup modules were unused; its failed receipt remains. The pure MMKV reader succeeded independently. After the ordinary status UI initialized the existing modules, the broad reader succeeded and confirmed the unchanged complete fingerprint/counts. No forced imports or repeated app operation was used to manufacture a pass. Postcold recovery-discovery provenance is ephemeral/idle; persisted account/content checks are reported separately from the earlier restore-success provenance. Reused evidence and remaining scope: earlier exact-be89 iOS recovery/cold and Android strict16KB/producer/account/consent checks remain under their own receipts. iOS also retains the same two-extra-node whole-image comparison difference. The earlier lost-response extra-request condition remains FAIL, with its reconciliation evidence and parked C8 scope preserved. Older-copy, protected Delete/recreate and additional safety permutations remain NOT RUN / owner-deferred under the latest explicit reduced scope; none is reported as passed. C8/stress remain parked. Physical HARDWARE remains NOT RUN / OWNER-DEFERRED PHYSICAL under exact-be89 owner comment #7045 (comment) . The complete required native matrix and independent CI/security/human-review/production/store/artifact gates remain incomplete. Source/readiness/public contributor pins and hosted gates remain unchanged. No merge, deployment, release signing, private-data upload, submission or publication occurred. EvidenceActual private evidence is under
Independent read-only audit: Coordinator closeoutLive head rechecked unchanged/draft/unmerged. This updates the Android startup/recovery blockers in report6266237967; earlier ANR and failures remain retained. No APK or app source change was needed to complete the requested case. The original startup latency cause is not uniquely proved merely by the cache-preparation/retest sequence. The idle consentOFF app5814 and owned VM25964 were stopped only after requested checks completed, queuedRevision0/runningFALSE and guest sync. All AVD/accounts/installed app/ART cache/fixtures/evidence retained, owner simulator6350 untouched. Graceful-closeout receipt SHA2565c9e0dbaa01adfdd9ce1376085971669ecc5cb1464de0abf2e8788a51d6a728f. Metro12375, fixture12510 and Mongo remain available; all old and current databases are preserved. Combined requested-case result ANDROID_RECOVERY_RESTART_RESULT.json SHA2561184c1f4c289fd05df14b241d0188ca5fff4f0747a4f19241844423d7f153142. Final actual UI displayed Automatic backup is off / copies not deleted; capture SHA256514a1d7bcd547e3059dbb1eb05fec9da60f5ae74d90a7fd9a1ea9c7e6a3815b0. Reader/input/transition-capture failures were retained and corrected through native UI observation; no new app operation or rebuild cycle was added. Mandatory storage closeout12:04:05UTC:23.215172GiB free versus unchanged conservative22.5GiB forecast including20GiB reserve,0.715172GiB margin; below30GiB advisory. Guard minimum23.213528GiB, no reserve breach. Five source/status guards matched. Actual helper exit2 on the known protected embedded-worktree fingerprint limitation; manual conditional arithmetic only, no helperPASS, cleanup or further heavy-operation admission. ContextSHAbb39d727eda9bbdf141cde51e8c8a67a586aec0559c5cd60f8a03f8d9a39f076; receiptSHA9466723d2a23c14e9b45b5728e559697707dcbff612cd04e982ec047171d8265. No other acceptance cases were repeated. No merge, source/readiness/pin/gate change, production write/deploy, release signing, upload, publication, private-data transfer or transaction. R4 remains independent of Reproducibility and Bitkey. Execution of this requested batch is complete; separate release gates remain open. |
Codex local validationState: LOCAL_PASSED PASS applies only to the owner-selected tested subset. Release readiness remains NOT READY. This is an evidence/report disposition after completing the remaining normal Android recovery/restart case, not another execution, source change, equality rewrite or gate change. The owner reduced the remaining scope in 6266011374; the completed actual Android evidence is preserved in 6266792652, with saved iOS results in 6230795563. iOS build/simulator: PASS for this tested subset: actual current-source simulator build/install/launch, normal protected Recovery Key restore of every backed-up wallet/key/label/vault record and metadata, original account/provenance, actual cold PIN/Home, unchanged complete committed Realm fingerprint/counts and native MMKV consent OFF before opening status. Keys/Portal introduction UI only. Native2.6.4/620; receipt SHA256 0a4691a8889230982cb7bb44bc12c60415008cb8fdda64e67d3f2507abaa2b85. Android build/emulator: PASS for this tested subset: saved current-source developmentDebug build/install/launch and strict16KB native evidence, plus completed normal4KB protected Recovery Key restore of every backed-up record/metadata and original account/provenance, actual cold PIN/Home, unchanged complete Realm fingerprint/counts and native MMKV consent OFF before status. Same retained2.6.4/627 APK SHA256 2e4431efac4f4218b8b11c5861a28f26ad7aa18f2ccb9aedf3d851b66207792a; no rebuild/reinstall/reset. Case receipt SHA256 1184c1f4c289fd05df14b241d0188ca5fff4f0747a4f19241844423d7f153142. Earlier startup ANR remains recorded; same artifact subsequently passed after package-only ART preparation (actual verify filter). The original latency cause was not uniquely proved. Real devices/signers: NOT RUN / OWNER-DEFERRED PHYSICAL under the exact-current-head owner decision 6231002359. No physical pass is claimed. Exact comparison and safety limitations retained
Open issues / next action: NOT RUN / POST-RELEASE — owner-deferred older-copy recovery, protected Delete/tombstone/recreate and extra/original-order bootstrap/reconnect/native permutations under6266011374. C8/navigation/stress remain parked; previous failed attempts, full-image difference and extra-request FAIL stay preserved. The original full matrix was NOT completed. No further native execution is proposed merely to repeat valid passes. Other checks: Reuse exact-be89 genuine private-v3 43/43, recovery480/480, Jest42suites/432tests and scoped release/version receipts. Public838 v2 protocol CI is still FAIL/incompatible and is not replaced by the private43-pass proof. CodeQL security aggregate remains FAIL/one High pending formal disposition; no current-head human approval is recorded. Release readiness: NOT READY. Current-source human/security review, honest public-v2/private-v3 CI integration, complete production backend artifact/config/old-writer/cutover/rollback readiness, reviewed hosted activation, fresh store histories/counters/configuration, final production artifacts and channel-specific authorization remain separate. Hosted readiness/pins/gates are unchanged. This subset sign-off authorizes no merge, production change/deployment, release signing, AAB/split construction, upload, submission, publication, private-data transfer or real transaction. All fixtures/accounts/VMs/databases/evidence remain retained. No tests were repeated for this review/report disposition. |
Codex local handoffState: NEEDS_LOCAL Goal and acceptance criteriaPublish only the owner-approved six-file client-availability change for intended2.6.4 store review. Hosted signed-v3 availability is compiled ON; per-account opt-in/defaultOFF/restoredOFF and all original authority/session/consent/Realm/generation/fingerprint/CAS/crypto/readback guards remain. Compiled availability is not evidence of deployed backend readiness. Public release remains HELD pending actual backend readiness and separate release approval. No Cloud signing/build/upload, merge, production connection/deploy/DDL or app-counter/config change occurred. Exact changes and publication verificationParent:
Before normal safe push, live PR head stillbe89 and exact raw full-index diff/6Gitblobs matched approved patch. Cloud checks — reused exact-byte proof, no new test campaignNo new tests, implementation, native build, fixture startup or broad reruns were requested or performed in this publication stage. New checks are source/publication integrity only: six-path/byte/SHA/Gitblob whitelist, exact full-index patch, fulltree, cleanworktree, fast-forward/livehead, unchanged2175members and Previously reviewed proof remains explicitly scoped:8/8offline admission cases,2CJSsyntax checks and the one actual changed genuine admission case1selected/1PASS/0FAIL/0reportedSKIP. The other42 private cases were deselected, not executed passes. That genuine case ran on five-file proposal tree4447761f with every runtime/test byte identical to this final six-file tree; sixth change is documentation only. Node22.23.3/OpenSSL3.5.8/native encryptedRealm12.15 and exact private7693 transactional credential-free loopback fixture were actual original inputs. No hosted endpoint was contacted. Focused receipt SHA256 Old public-v2 result295total=2PASS/293FAIL remains protocol-CI debt, not293 independent bugs and not replaced by private43. Existing backend38+6/privateCI43+3 retain their exact older inputs/source scopes. Automatically triggered Tests/CodeQL are left intact; their current results must be read as actual checks, not presumed green. Diagnostic cancellationOnly automatically triggered Android diagnostic run39261373729 for this exactSHA was canceled. It was observed queued when cancellation was requested; final API status is completed/cancelled, job118089598277 also cancelled with an empty recorded step list. No checkout/Gradle/sign/upload step is recorded; do not relabel unreported steps as explicitSKIPPED. Actual artifacts endpoint count0. Tests/CodeQL untouched; no workflow dispatch or production ref push. Local checks requested — finite iOS first, Android still requiredUse the actual currentSHA above in a safe isolated Local checkout; do not overwrite dirty/embedded worktrees or assume any Cloud path exists on Mac. Keep owner-reduced native/recovery subset and parked cases intact; no renewed broad native/provider/stress/permutation campaign.
Preserved results, counters and remaining boundariesAccepted be89 IOS/ANDROID owner-reduced subset and physical deferral remain historically valid only forbe89. Whole-current equality there remainsFALSE solely two additive standard publicTestnetdefaults336/337; that precise accepted additive condition is not full equality. Lostreply2requests/1commit/409FAIL and owner-deferred older-copy/Delete/recreate/extra permutations, C8/navigation/stress remain parked with original evidence. No gate/failure is waived or rewritten. Version2.6.4 /provisionalAndroid627 /iOS620 are unchanged, not newly certified free by Cloud. Local must complete fresh actual globalPlay/store-history/counter/approved-nonsecret-production-config/signing/artifact checks near its final builds; do not invent a counter baseline. Store submissions remain Local-owned under prior owner authorization, with MANUAL public release/managedhold and separately approved public publication. No new Cloud native/signing/upload or backend permission from this handoff. Backend readiness/runtime/config/DB/audience/ingress/newcollection provisioning/transaction/CAS/writerdrain/fence-compatible rollback and security review are separate unresolved prerequisites. Existing fixed read-only production-check work is independent; this app-publication stage attempted no production execution. R4 remains independent of Reproducibility, Bitkey, cloud-bootstrap/#7059/#7061 and parked work. CurrentSHA native states: IOS NOT RUN; ANDROID NOT STARTED; HARDWARE NOT RUN. StateNEEDS_LOCAL, not release-ready. |
Codex local scope decisionState: OWNER_DEFERRED_PHYSICAL Only unrun physical checks are deferred. IOS and ANDROID remain required. No known critical failure is waived, no failed physical test becomes a pass, and this decision does not authorize public release, backend deployment, merge or bypass of other release requirements. |
Codex local validationState: BLOCKED Actual results — 19 October 2026
Accepted evidence reused; no broad test campaign: current GitHub CI run39261373733 passed Lint,42Jest suites/432tests,480recovery tests(0fail/0skip), source-version and release-tool checks. Its actual checkout was merge commitdd1e71479fb9394333d501b72d723618dcdb5d4e; Local independently verified its complete Git tree equals the exact ffb89 tree above, with no source diff. CodeQL and Public backend setup workflows succeeded. This does not dispose the previously recorded numeric-ASM security finding. The same CI run's public automatic-backup job remains FAIL:295tests=2PASS/293FAIL/0SKIP against unchanged public Relay838049e537e07eb646a2a0393eb969fba43d0739. Initial failures occur in the encrypted snapshot baseline setup before the requested operation. The already documented public-v2/private-v3 integration debt remains; it is not replaced by the separate older private43+3 proof. No pins changed or CI rerun. Artifacts and preservationPrivate Local evidence folder:
Open issues / next action
Release readiness: not ready for release; no LOCAL_PASSED claim. Live head rechecked unchanged after compilation. No merge, backend deployment, private-data transfer, release signing, upload, publication or real transaction. |
Codex local validationState: BLOCKED 20 October command-line progress
Required local checks
EvidenceLocal evidence remains under
Inputs, commands, exact graph approvals, typed products, failed attempt, logs and resource receipts are preserved. These are local artifacts; private configuration, fixture data and credentials have not been uploaded. Open issues / next actionFinish current-source required native acceptance and final artifacts; restore store sign-in and refresh the small current store-history/counter/hold window; reconcile the release metadata under the existing Cloud/source approval workflow. Actual unchanged publication preflight still FAILS stale Apple and Google baseline checks. Independent current-source human/security disposition, public-v2 CI incompatibility and backend operational readiness retain the previous exact-source report scopes; none is marked fixed by these compiler passes. Owner-parked older-copy, Delete/recreate, C8/navigation/stress and other deferred cases stay parked; no scope expansion or test waiver. Hosted client availability ON is not production backend readiness. Release readiness: NOT READY / BLOCKED. No LOCAL_PASSED, signing, final APK/AAB, installation/UI pass, store upload/submission, merge, backend deployment or publication is claimed. Public release remains held. |
|
@Parsh @ben-kaufman — the release owner has requested an independent developer review of the current 2.6.4 candidate, exact head Please review this current candidate and leave an approval or specific concerns against this head; earlier approvals reference older code. The latest six-file delta enables compiled hosted signed-v3 client availability while retaining per-account default/restored consent OFF and the authority, session, generation, CAS and complete-readback protections. Review the combined candidate as appropriate, not only that final delta. Local is continuing the narrow owner-approved availability/final-artifact verification, reusing completed tests. The PR remains BLOCKED: compiler passes are not native UI acceptance, and source approval does not establish backend readiness or clear the recorded CI/security/release gaps. This request does not ask for a merge or deployment. |
Codex local validationState: LOCAL_PASSED This passes the owner-selected current-source availability/update/cold-start subset below. It does not claim the original full matrix, deferred scenarios, final production artifacts or release readiness. Live head rechecked unchanged; PR remains draft/open/unmerged, targeting iOS build/simulator: PASS — selected subset. Current 2.6.4(620) ARM64 Debug simulator build installed in place on the retained disposable B373 fixture. All four Realm/MMKV files were byte-identical before/after installation, before first launch. Actual first cold launch, PIN/Home, canonical native MMKV/live-store consent OFF before status, one ordinary protected-status visit and guarded native state passed. Both current hosted-availability exports/source-ready were true; one retained account, committed Realm fingerprint and all collection counts matched the saved be89 proof. Status showed automatic backup OFF and both copy-retention notices. Exactly one signed snapshot returned HTTP200; zero enrollment/mutation/committed writes/faults. Current-source Metro, native artifact/config, process/device and inspector identities were guarded before/after reads. B373 was gracefully shut down; other simulators were unchanged. Android build/emulator: PASS — selected subset. Current 2.6.4(627) developmentDebug APK installed in place on the retained disposable ARM64 normal-4KB fixture. All four Realm/MMKV files were byte-identical across installation before launch. Actual cold launch, PIN/Home, canonical native MMKV/live-store consent OFF before status, availability exports, retained account/Realm identity and ordinary status passed. Status eventually showed automatic backup OFF and both retention notices. Exactly one signed snapshot returned HTTP200; zero enrollment/mutation/committed writes/faults. App/current-Metro/device/artifact/config guards matched. AVD5562 was gracefully stopped with its data retained. This is not a new current-head strict-16KB or all-ABI production artifact pass. Real devices/signers: NOT RUN / OWNER-DEFERRED PHYSICAL under the exact-source owner decision6269602510. IOS/ANDROID and known critical failures are not deferred. Actual qualifications and preserved failures
Reused proof and unrun scopeThe accepted be89 recovery/restart subset6267025539 remains explicitly scoped to NOT RUN / POST-RELEASE or PARKED: older-copy recovery, protected Delete/tombstone/recreate, additional bootstrap/reconnect/native permutations, navigation, C8 and stress, under the existing owner scope decisions. C8 and the parked failed case retain their failed evidence. No new scope waiver or blanket acceptance is claimed. Other checks: current-source iOS unsigned device Release/static packaging (19 October), Android production Hermes/Java/Kotlin preparation (20 October), and today's Debug/static products passed within their recorded scopes. All 97 Android native libraries and 56 iOS native files match retained be89 bytes; current runtime JavaScript is bound to ffb. Current-tree CI39261373733 reused Lint,42 Jest suites/432 tests,480 recovery tests and version/release-tool passes. Its automatic-backup public-v2 lane remains 2 PASS /293 FAIL /0 SKIP, so aggregate CI is FAIL. Current CodeQL analysis/public-backend setup workflows passed; no security disposition is inferred. No broad test campaign was repeated today. Open issues / next action — separate release requirements
Exact evidenceReceipts remain in the existing private Local evidence root,
Storage assessments/manual conditional admissions were recorded before serial builds/runtime. Normal20GiB reserve was retained; lowest saved iOS sample20.515GiB. The helper's protected embedded-worktree fingerprint warning remains exit2 / no helper PASS; no cleanup occurred. All source, paused caches, devices/accounts/wallets/databases, artifacts and prior evidence remain preserved. Release readiness: NOT READY. Local owner-selected IOS/ANDROID subset passed; physical-only deferral and every parked/unrun/failing scenario remain explicit. Fresh store inputs, final signed artifacts and actual submission remain incomplete. Recorded nonrequired CI/scanner findings stay explicit as follow-up; routine developer reviews are optional/nonblocking under the owner's decision. No merge, production deploy, release signing, upload, submission, publication or real transaction occurred in this native batch. R4 remains independent of Reproducibility and Bitkey Wallet. |
Owner release review decision — R4 / 2.6.4PR: #7045 The release owner explicitly instructed on21October2026: developer reviews are optional, and2.6.4 must not wait if reviews do not arrive in time. Apply this owner exception to R4 /2.6.4: independent developer review is nonblocking for the authorized release preparation/store submission. Existing requests to Parsh and Ben stay open. No current-head developer approval is claimed. This supersedes the earlier statement that missing current-head developer approval blocks this release. Current Local selected-subset results, recorded security/CI findings, fresh store inputs, final artifact verification and the backend/public-release hold retain their existing actual status. No repository source, pins, readiness constants, automated gates or branch rules are changed by this decision. This comment performs no merge, deployment, signing, upload or publication. |
Codex local scope decisionState: OWNER_DEFERRED_PHYSICAL Only unrun physical checks are deferred. IOS and ANDROID remain required. No known critical failure is waived, no failed physical test becomes a pass, and this decision does not authorize public release, backend deployment, merge, or bypass of other release requirements. |
Codex local handoffState: NEEDS_LOCAL |
Codex local validationState: LOCAL_PASSED PASS is limited to the owner-selected current-availability/update/cold-start iOS/Android subset. The 1d8 commit changes only release/version.json store-baseline fields. The app/native sources, compiled version numbers, configuration, dependencies, pins and readiness gates are byte-identical to tested parent ffb89f2. No new native build, device run or full matrix is claimed for 1d8; the actual iOS/Android execution remains attributed to ffb89 in its detailed report. iOS build/simulator: PASS — carried-forward selected subset from ffb89, unchanged native inputs: 2.6.4(620) Debug simulator built, installed in place and launched on a retained disposable account; four Realm/MMKV files survived installation byte-for-byte, cold PIN/Home, canonical consent OFF and one ordinary protected-status visit passed. No new iOS execution on 1d8. |
Exact-source 2.6.4 store submission checkpoint — 21 Oct 2026PR #7045 remains draft/open on
These are artifact and store results on the exact head. No new iOS/Android device acceptance run is claimed for this metadata-only head; the earlier selected native results, explicit parked cases, and exact-SHA physical-only owner deferral remain as reported in the local-validation handoff. Production Relay readiness is being handled separately and is not established by these store submissions. Keep both app channels and the public APK held until the owner’s release decision and backend readiness. No merge, Relay deployment, gate/pin change, or public publication occurred here. Private build logs, signing inputs, and local test data remain in the preserved Local evidence directory; only hashes and sanitized outcomes are in this comment. |
Codex local handoff — standalone APK publication, R4 / 2.6.4Owner authorization (27 October 2026): In the release coordination thread, after being told that Play Store 2.6.4 is published but the standalone APK is not, the owner said “do it.” This is approval to publish only the already-built, signed standalone Bitcoin Keeper v2.6.4 Android APK (build 627) and its four-file GitHub release verification set. It is not approval to merge any PR, deploy Relay, alter Play/App Store channels, change source, rebuild unnecessarily, rotate signing material, publish a different version, or release unrelated artifacts. State: NEEDS_LOCAL_ARTIFACT / NOT YET PUBLISHED. Fresh GitHub release API readback: latest public release is v2.6.3; v2.6.4 tag/release returns 404. The signed local files are not available as a public release or a GitHub Actions artifact; the originating 21-Oct checkpoint says they are preserved in private Codex Local release evidence. No release write or publication occurred in this coordination check. Exact artifact provenance to require
Required Codex Local executionRead If and only if these checks pass, create the v2.6.4 release at exact source If any original artifact is absent/inaccessible, hashes/signatures mismatch, source/tag differs, signing authority cannot be established, or a current critical release gate has regressed, STOP and report the precise blocker rather than manufacturing, uploading an unverified APK, or claiming completion. |
Standalone APK publication — R4 / 2.6.4State: PUBLISHED / public download verification PASS. Completed the owner-authorized standalone handoff. Bitcoin Keeper v2.6.4 (release ID The original preserved R4 files were reused byte-for-byte; no rebuild or re-signing. Original build/signing receipts bind this APK hash and embedded bundle hash to the approved source. Fresh inspection confirms package Both the signed checksum and detached APK signature verify using a fresh public-only key fetched from keys.openpgp.org:
An independent unauthenticated check completed at 12:05:04 UTC: public release page/API and actual GET downloads of all four assets returned HTTP 200. Every downloaded size/hash matches the original files and GitHub digests. The downloaded signed checksum content, both PGP signatures, Android signature/certificate and package/version checks all PASS. Readiness rechecked: exact-source Tests and No PR merge, backend deployment/restart, Play Store or App Store change occurred. Only this GitHub release and its exact four assets were published. |
Current R4 reconciliation — 22 October 2026
Submitted source
1d8a86a7462d935cbd0e28b857934b5718c152fc; public release remains HELD under the current owner instruction. Do not rebuild or resubmit iOS620/Android627.29597b27eeeb299205bf7d0555db0a90c38cc4be. Older undeployed/readiness wording below is superseded. Website#19 is merged/deployed with8/8 public HTTP checks; installed-app/device acceptance remains open.keeper/local-validationPASS for the recorded owner-selected subset/qualified unchanged-input carry-forward. No new full native run is claimed. CodeQL's separate security-result and the public-v2 genuine-backup lane still FAIL; private paired proof does not waive them.Completion ledger and exact remaining actions. New private Relay#161 on fixed submitted1d8/deployed29597 passed 43/43 protected cases +3/3 guards, zero skips (run39832222599); the separate public295 result remains2PASS/293FAIL and CodeQL remains red. Desktop#103 full CI/12guards passed; its existing QA archive now has a verified owner-only cloud retention copy.
No merge, deployment, signing, store action or public publication is authorized by this reconciliation. Historical reports follow with their original source/date limits.
Preserved historical checkpoints — current-state wording is superseded above
Latest 2.6.4 store submission checkpoint — 21 October 2026
Exact PR head:
1d8a86a7462d935cbd0e28b857934b5718c152fc. Signed iOS 2.6.4 (620) was uploaded and is WAITING_FOR_REVIEW with MANUAL release. Signed Android 2.6.4 (627) is IN_REVIEW on Google Play; 2.6.3 (626) remains PUBLISHED, and owner evidence shows Managed publishing ON. The public APK is built, checksummed and signed with Keeper's established PGP key; both signatures verified against a fresh public key fetched from the documented keyserver. GitHub upload and public release remain pending. Production Relay readiness remains separate and unverified. Do not merge, deploy, or publicly publish based on store submission alone. Exact artifact hashes, checks and limits: Local store checkpoint. Earlier native acceptance and scope reports remain source-qualified; no new device run is claimed for the metadata-only head.Current R4 / 2.6.4 release metadata checkpoint — 21 October 2026
Head:
1d8a86a7462d935cbd0e28b857934b5718c152fc, a one-filerelease/version.jsonrefresh over ffb89. LOCAL_PASSED for the owner-selected IOS/ANDROID subset by unchanged-input carry-forward; release NOT READY and nothing submitted.Authenticated Apple inventory found latest uploaded iOS build619; build620 is unused. Owner-direct Play Console screenshot showed the latest global bundle code626; candidate627 is absent. Play managed publishing is ON. Version intent2.6.4/620/627 is unchanged; fresh baselines were committed, and version check, release-tool tests and clean exact-HEAD release preflight passed. Native app inputs are unchanged from ffb89, whose selected simulator/emulator proof is retained with its original source attribution. The prior failed/parked scenarios and public-v2 CI/scanner findings remain disclosed.
Final signed IPA/AAB/APK, artifact verification, upload and held store-review submission are outstanding. The production backup backend is not yet proven ready; public release remains HELD. Developer reviews are optional for this release under the owner's recorded decision. PR remains draft/open/unmerged against
sprint. No backend deployment, public publication or gate/pin/readiness change occurred in this metadata step.Current R4 / 2.6.4 checkpoint — 21 October 2026
Head:
ffb89f28ace014bc581c53895b16260f2c8f4dd8. LOCAL_PASSED for the owner-selected IOS/ANDROID subset; release NOT READY.Both current Debug artifacts were built, installed in place and actually launched on retained disposable fixtures. Four Realm/MMKV files per platform survived installation byte-for-byte. Cold PIN/Home, canonical native consent OFF, current hosted-availability exports/account/Realm and one ordinary protected-status visit per platform passed. Two signed snapshot HTTP200 responses total; zero enrollment, mutation or committed writes. Initial automation/setup failures and slow observations remain recorded. Both task devices were gracefully stopped with data retained; owner devices were unchanged.
This is the selected current-availability/update subset. Prior be89 recovery/strict-16KB proof remains source-qualified; no new clean recovery, whole-image equality or full original matrix is claimed. Owner-parked older-copy/Delete/C8/navigation/stress cases and historical failures remain explicit in the report.
Hosted signed-v3 client availability is compiled ON; per-account consent remains default/restored OFF. This does not establish production backend readiness. Developer reviews are optional/nonblocking for2.6.4 by the owner's21October decision; existing requests stay open. Required Tests and local-validation checks pass. Recorded old-protocol CI failure and the source-supported scanner false positive remain visible as follow-up; no further reviewer wait is introduced. Fresh store histories/counter metadata, final production signed IPA/AAB/APK verification and upload/review submission remain incomplete. Existing signing assets are documented; test artifacts are not production artifacts.
The owner authorized 2.6.4 store preparation/review submission with public release held until the backend is ready. This update does not merge, deploy, sign, upload, submit or publish anything. PR base remains
sprint; draft/open/unmerged.The description below is preserved historical context; its older current-state wording is superseded by this header and linked21October report.
Current R4 / 2.6.4 checkpoint — 20 October 2026
Head:
ffb89f28ace014bc581c53895b16260f2c8f4dd8. BLOCKED / required native checks incomplete / not release-ready.The approved six-file change compiles hosted signed-v3 client availability ON. Per-account automatic backup remains default OFF/restored OFF; this is not proof that the production backend is deployed or ready. The unsigned iOS device Release build/static inspection and Android production JavaScript/Hermes plus Java/Kotlin compilation passed on this source. Android native CMake/NDK and complete APK/AAB construction remain NOT RUN. Current-source IOS/ANDROID required acceptance, final signed artifacts, store checks and human/security/CI disposition remain incomplete. Existing owner-reduced scope and parked cases are unchanged.
The owner authorized preparing and submitting2.6.4 to Apple/Google with public release held while backend work finishes. Public app/APK publication, merge and backend deployment remain HELD. No signing/upload/submission is claimed.
The description below is preserved historical context. Its be89/OFF/current-state wording is superseded by this header and the linked current handoff/report.
Current protected-backup / recovery ownership correction — 16 October 2026
Head
be89c34473bb6aab253b98325f1fe746ca391c6f. NEEDS_LOCAL / R4 BLOCKED / NOT RELEASE-READY.Current exact-SHA Local handoff · Current source guide. This supersedes paused03e and earlier v2 instructions; every historical failure/control/pass remains SHA-scoped.
The same-session stale recovery race is reproduced and corrected. Original request checkpoints span decode/derivation/consent/Realm writes and Redux effects; only recovery's watcher uses takeLatest to cancel called children, with cancelled cleanup suppressed. Six-file delta from03e, no native/dependency/config/pin/gate changes. Test proxy now uses three fixed literal destinations. No wallet fee code changed.
Exactbe89 43/43 genuine +3/3 guards +480/480 recovery +42Jest suites/432 tests +version PASS, zero skips; real encrypted native Realm/production authority, queue, store and crypto/transactional private fixture. Independent source/proof review ready. Strong savedtrue-old03e RED0/2 and construction fixture failures preserved. TypeScript still944 baseline/current; changed-module lint10errors/2warnings both, normalized0added. NativeIOS/ANDROID/HARDWARE/Hermes runtime/HTTP NOT RUN in Cloud.
Fresh CodeQL security aggregate117072301546 FAIL: one High ASM warning only; Critical proxy alert absent. Independent exact-consumer evidence supports the remaining HTML-injection false positive: unchanged text stays local and only its numeric count reaches fee sizing. No dismissal/gate waiver; successful analysis is not a securitypass. HostedTests117071547659PASS on syntheticmergef72243c012ba6e3cad56d4a27b1179d1b5adbd18, not native/exact-source acceptance. Public838v2 genuine CI remains incompatible/unresolved; no pin/guard/export workaround. Local gate awaits exactbe89.
Local cancelled diagnostic38930088123 during JS dependency installation after checkout/SDK; configuration/Gradle/APK/AAB/sign/artifact/upload SKIPPED. Tests/CodeQL left running. Ordinary nonforced fast-forward preserved all work; no competing PR. Local storage/dependencies prepared, actual current-source native tests still required.
Protected-v3 all7 operations/repair/Delete/restore retain separate backup authority and original Keeper/provider identity, committed local ownership/original CAS/generation/epoch/readback. Scoped Delete removes only new protected copy; older encrypted copies remain read-only with EN/ES notice, explicit older recovery and no automatic fallback. Restore keeps consentOFF. Hosted automatic, protected Delete and manual repair remain OFF. All-copy purge is outside R4, unimplemented/unscheduled.
Backend human/crypto/operational/cutover readiness; protocol CI; exact-head native/review/physical scope; source/counter/artifact/store/channel approval and separate Desktop/website/R4 work remain open. No merge/deploy/activation/sign/upload/submission/publication authorized. Independent of Reproducibility/Bitkey.
Historical records follow unchanged.
Current protected-v3 integration — 16 October 2026
Head
03e4138c2391f930d9ed158c1b92b6493ba58484. NEEDS_LOCAL / R4 BLOCKED / NOT RELEASE-READY.Exact-SHA Codex local handoff and copy-ready Local instructions. Current guide: protected backup app handoff. This supersedes historical v2 setup below for current source; earlier failure/control/native evidence remains SHA-scoped.
All7 automatic operations, explicit opt-in/full repair, status/Delete and recovery use recoverable signed v3 authority with separate backup identity, original CAS/generation/epoch/session/consent and complete raw/decrypted metadata validation. Protected/explicit older restore keeps target consentOFF. Owner-approved Delete removes only the new protected copy; older encrypted copies remain read-only with EN/ES notice and no automatic fallback. All-copy purge is outside R4 and unimplemented. Hosted automatic, Delete and manual repair remain fencedOFF.
Exact-head genuine 38/38 + guards3/3 PASS, zero skips, actual encrypted native Realm/app crypto/production consumers/transactional loopback backend. Broader recovery480/480, signer13/13, Jest42suites/432 and release28Node/7Python/21Ruby(117assertions) have exact execution scopes in the handoff; none is native acceptance. Initial failures, genuine RED fixes and later37/1 invalid node-test premise remain recorded. TypeScript remains944 errors on baseline/current; measured runtime/UI lint adds0 normalized findings. Independent engineering source/dependency review ready; native/professional certification not claimed.
Five exact JS pins/six new lock selectors; all2274 old selectors and native/Portal/JNA/config/contributor inputs preserved. Added code/test byte estimate177547≈44–51ktokens exceeds advisory budget, mostly proof. IOS/ANDROID/HARDWARE and actual Hermes/nativeHTTP remain NOT RUN in Cloud. Old physical scope does not transfer.
Diagnostic 38926232053 CANCELLED during JS dependency installation after checkout/SDK setup; Gradle/APK/AAB/sign/artifact/upload steps SKIPPED. CodeQL/public-backend setup succeeded; CI38926232056 was pending. Public838 v2 genuine lane remains incompatible with v3, without waiver; private proof is separate. Exact-head Local gate remains unsatisfied.
Backend operational/security/cutover readiness, public CI integration, current-SHA native/review/physical scope, source/version/artifact/store/channel approvals and separate Desktop/R4 dependencies remain open. No merge/deploy/hosted enablement/sign/upload/submission/publication authorized. Independent of Reproducibility/Bitkey.
Historical combined-candidate evidence follows unchanged.
Current managed node-bootstrap producer — 15 October 2026
Head:
4927ad549dd1d610d9eb84c6d9a37ed0a6f33a29. NEEDS_LOCAL / NOT RELEASE-READY.One bounded missing-producer correction: normal detail refresh created recoverable
default nodes without a managed receipt/enqueue. Unchanged9a19 actual-caller RED
persisted defaults with CAS0 where1 was required. Original authority now flows
through dispatch/direct callers into one atomic append-only node commit and a
background exact-set backup. Custom/mixed-network nodes, fallback deletion,
no-op behavior and all session/consent/Realm/generation/CAS/readback guards remain.
No observer upload, late rebase or manual-conflict change.
Cloud PASS295/295 genuine (zero skips/native prerequisite passed;20new cases),
448recovery,42Jest suites/432tests,28Node+7Python+21Ruby/117release assertions,
version/focused network lint/diff/links. Independent safety review: no blockers.
Whole TypeScript still FAIL944 at both9a19 and newsource, normalized0added;
other touched modules retain12lint errors/17warnings,0added. Initial fixture
setup failures are disclosed. New-head native/UI/MMKV/hardware NOT RUN inCloud.
Current exact-SHA Local handoff and copy-ready prompt
requests incremental Android developmentDebug/iOS simulator Debug artifacts and
ORIGINAL order: initial Verified/no nodes→ordinary detail bootstrap→AUTOMATIC
complete Verified without manual bridge→ordinary rename→full renamed readback
and cold PIN/MMKV/Realm, BOTH platforms. Native/dependency/configuration/manifest/
JNA/Portal/pin/gate inputs remain byte-identical to9a19. Required IOS, ANDROID,
HARDWARE; old owner physical scope does not transfer to the new SHA.
Diagnostic 38681894775
was CANCELLED while queued: final jobs API runner_id0, no assigned runner,
steps[]. No checkout/build/sign/artifact/upload ran; no per-step skipped-status
claim. Main CI38681894757, CodeQL38681894766 and backend38681894860 were pending
at publication; keeper/local-validation remains unsatisfied awaiting actual Local.
The original9a19 bootstrap failure stays preserved. Its healthy-baseline native
rename/fullcrypto/cold CONTROL passed separately; it does not pass that bootstrap
order.17e0 failure and expected conservative manual Needs Review remain separate;
its exact native cause was never uniquely proved. C8/#7056 stays parked/failed.
All remaining native/review/backend rollout/fleet/index/transaction/old-writer,
store/config/counter/artifact and separate Desktop/website gaps remain open.
No merge/deploy/index/release signing/production AAB or split build/upload/submit/
publish/customer message/real provider/transaction approval. R4 stays independent
of Reproducibility/Bitkey Wallet. Earlier source/evidence below are preserved.
Preserved backup inspection queue correction at9a19 — 15 October 2026
Head:
9a19c6a2a4b4b71d6ffb0d6a5b9776f12a7dbf1d. NEEDS_LOCAL / NOT RELEASE-READY.One approved narrow source cycle: move verified-baseline invalidation into every
admitted account-queue inspection callback, after its captured-session stale
return and before inspectOnce. Retries retain the same deadline; coalescing,
original proof/session/consent/generation/fingerprint/CAS and all gates remain.
Only app code changed:
src/services/backup/repair.ts. Native/build/config andJNA/Portal/dependency/pin inputs are byte-identical to17e0; exactly4files changed
(one module,12-case genuine matrix and2evidence/handoff documents).
Cloud PASS: genuine275/275,0skips; new focused12/12; original required-behavior
case GREEN1/1 versus preserved17e0 RED0/1; recovery448/448; Jest42suites/432tests;
release28Node+7Python+21Ruby/117assertions; version/focused ESLint/diff checks.
Independent agent safety/diff review PASS. The initial focused11/12 fixture-hook
failure and test-only correction are disclosed. New-head hosted CI is pending.
Cloud native build/install/launch/UI/hardware is NOT RUN. Diagnostic38678482569
was cancelled during Java setup: checkout/Node setup completed, all SDK/build/
signing/artifact/upload steps skipped. Pre-checkout cancellation was not achieved.
Current exact-SHA Local handoff and prompt
requests incremental new artifacts and ONE focused ordinary rename/native smoke
retest on BOTH platforms, without repeating unrelated large matrices. Required
checks remain IOS, ANDROID, HARDWARE. Old17e0 Android16KB/4KB/static and iOS compile
results stay SHA-scoped. Any new native failure must be preserved/reported;
no further speculative fix/rebuild cycle is authorized here.
The 17e0 diagnostic/proposal comment
remains intact with3diagnostic outcomes and separate0/1RED. The exact native
ordinary-rename cause was never uniquely proved. Preserve its local saved rename,
remote-unchanged/pending outcome. Latest Local manual Back Up Now→Needs Review
is diagnosed as expected conservative preservation/UX limitation, not a new
transport defect: only common wallet presentationData.name differs;2signers and
metadata match; no remote-only/unavailable records;2localnodesvs0remote are
additive. Existing repair.test deliberately expects this renamed-wallet conflict.
No manual retry/override/guard change is included or requested.
C8/#7056 stays owner-parked and failed. All existing native/review/backend fleet/
index/transaction/old-writer, store/config/artifact and separate Desktop/website
blockers remain. No gate waiver, merge/deploy/index creation, release signing,
production AAB/split build, upload/publication, customer message, real/paid provider
call or real transaction. R4 remains independent of Reproducibility/Bitkey Wallet.
Earlier source/evidence records below are preserved; the final handoff is current.
Preserved checker portability record at17e0 — 15 October 2026
Head:
17e0d9b9e3daf39359b762baa99b899f20b95f96. NEEDS_LOCAL / NOT RELEASE-READY.Exactly2checker/test files changed since5ed. Catch bare ZIP-read EOFError at the
entry boundary, retain its path/nonempty diagnostic, and emit FAIL JSON/exit1.
All app/native/dependency/configuration/manifest/gate/workflow inputs are unchanged.
Actual evidence remains distinct: Linux at5ed20PASS; Local MacPython3.9.6 at5ed
19PASS+1ERROR. Fixed CloudPython3.12 checker21/21PASS. The original malformed
fixture also reproduced bareEOF with the unmodified CPythonv3.9.6 zipfile module
underCloudPython3.12, then passed failure-reporting assertions after the fix.
This is module-level portability proof, not a Mac/fullPython3.9.6 pass. Prior5ed
hosted CI/CodeQL/backend checks PASS; new-head CI pending. No broad app test
repetition or Cloud native/UI attempt. Diagnostic38672149189 CANCELLED with no steps.
NEW exact-SHA Local handoff and copy-ready prompt.
Local can continue AGP graph work, rerun the21checker tests on actualMacPython3.9.6,
then build the already-planned developmentDebug artifact from this NEW SHA and
continue strict16KB/Portal/MMKV/Realm/wallet/backup/native smoke. Required checks
remain IOS, ANDROID, HARDWARE. Android C8/#7056 stays parked and failed. Whole-LOAD
RELRO evidence and all existing release blockers remain; no new app defect is
established by this portability error. No merge/deploy/release action authorized.
Earlier SHA-scoped source/evidence records below are preserved. The final
Codex local handoff section is current.
Preserved Android source correction at5ed — 15 October 2026
Head:
5ed23663d85ace753713a1dd506ab2b4d6ec2b69. NEEDS_LOCAL / NOT RELEASE-READY.Targeted source correction preserves the entire698078 candidate: strict matched
JNA5.18.1 AAR for Portal, a static ELF/RELRO/effective-program-alignment/APK-ZIP
checker with20 CI regressions, supplier inventory and exact-head Local retest.
The official5.14 supplier stripped bytes reproduce the reported failing APK
library SHA. LOAD64KB/ZIP checks pass; RELRO-prefix effective8192 explains the
separate strict-mode failure.5.18.1 retains the first fixed5.17 native bytes and
adds relevant UniFFI Structure fixes. Portal pin/exclusions, package/Yarn locks,
contributor manifest and both backup readiness constants are unchanged.
Cloud source checks: genuine263/263, recovery448/448, Jest42suites/432tests,
checker20/20, Gradle resolution-only3tasks and version consistency PASS.
Release28Node+7Python and offline Ruby21tests/117assertions PASS; the initial
host lacked Ruby, resolved with a network-disabled/read-only container. Preflight
FAIL because both store histories are stale. CodeQL/public-backend CI PASS;
main hosted Tests/genuine CI remains running, not yet a pass.
Diagnostic build/upload run38671137809 was cancelled before checkout/build.
Actual new-head Android/iOS builds, install/launch/UI/hardware and production
AAB/splits are NOT RUN in Cloud. The13AAR/50entry supplier sample is not the
unavailable full Local59-entry APK inventory; whole-LOAD RELRO exceptions mean
raw49/59 remainders are not49 demonstrated crashes.
Read the exact-head handoff,
supplier proof and Local retest
and retain the 698 LOCAL_FAILED report.
Required checks remain IOS, ANDROID, HARDWARE. Android C8/#7056 remains
owner-parked and failed; no new C8 fix/retest cycle. Full native/review/backend
rollout/fresh store/config/artifact and separate Desktop/website blockers remain.
No merge, deployment/index creation, release signing, production AAB/split build,
upload, publication, customer message, real transaction or real/paid provider
call is authorized. R4 remains independent of Reproducibility and Bitkey Wallet.
The earlier candidate/audit record below preserves its SHA-scoped evidence;
it does not validate this new head. The final handoff section is current.
Preserved R4 candidate record — 13 October 2026
Draft 2.6.4 candidate at
698078e1765d1e0728145f0ef6def05195192b30, targetingsprint. Automatic Assisted Backup now saves recovery data locally before preparing cloud effects. Each operation carries an immutable committed generation, originating account/session/consent choice and original verified Relay revision. Partial or uncertain writes retain local results and stay pending; complete decrypted readback is required before Verified.State: NEEDS_LOCAL / NOT RELEASE-READY. The genuine disposable proof passes.
AUTOMATIC_BACKUP_SOURCE_READY=truepermits DEVELOPMENT loopback with an explicit port;AUTOMATIC_BACKUP_RELAY_ROLLOUT_READY=falsestill fences every hosted automatic write, including hosted Delete Backup. No Relay deployment or release action is authorized.Exact integrated inputs
The current candidate preserves the live
bb66cea459fbb00ec33c5c4ebd601d07c0d7c125predecessor, including the exact #7051 import and #7052 keypad blobs, and itsb160656218dc6065ad12af9db220c974255bfc23baseline. Approved #7050's owner-directed physical-test policy, gate and 11 regressions are included without merging this PR. Source PRs remain separate. Final follow-up also expires saved/interrupted verification before actual Redux Persist reconciliation, gives canonical nested consent priority over stale root records in every load order/prefix, allows legacy fallback only after confirmed absence, preserves live nested persistence metadata, and requires current session/generation/fingerprint proof for displayed Verified.fee03fab6557595e3180b6fb895becf3a6f85815ac868253f3460dd875035e1a4f73fc99ca658c1b1370b99be49e48143ed9a685267ebd8d90cd632781bc417cb42372a4eb7dc918db073684f8bf2687d280c3b7ce879503998a9625a18d9be0ccd6d7da16a1a3f6c402e437f01e1f2204b3cdf438dd8907c3b9b37ece19e18ea3198e3bf6aaaf20b05660ab58208450c88c0aabd4a44df52630c35843c16484f8ca5a843838079cf2d653b036dd8617107aa38833a55df2b512b611e173dea6c7084458263ea961c5a60732569c7159678d46fba917ff3a9cea3aaa#7042’s final own-CI head is
163cccb831f824b3daacc05199421683abdaf1ad: two workflow-trigger lines and test-only deterministic network/VM setup plus wrong-key AES rejection assertion changed. The integrated runtime head in the table remains d280, with identical src/native/package/lock trees. No source base was changed.#7035/#7039 now contain test-only deterministic Electrum fixtures and the existing wrong-key AES assertion correction. Their crypto/app runtime is unchanged; #7039 also triggers CI/CodeQL on its actual stacked base. The integration deliberately retains the combined client's public-peer/failover/reconnect tests rather than importing the standalone legacy index-reset API.
The prior narrow
yarn.lock/Android input-hash import from #7043 ata137db160446083ddb4e1e870bb2b021cf7cf302is retained. No new #7043 code, independent reproducibility verdict or Bitkey Wallet work is included. Public Relay runtime remains pinned toee935359f22ff7932ea0a62e9084d4b49801f4aa; Relay #3's newd4d59b0head changes README only.Paired disposable proof dependency: Relay #4 at
838049e537e07eb646a2a0393eb969fba43d0739. Native Android found incomplete readback on the original b600 repair path; the paired fix adds subscription metadata after the revision checks. This is loopback evidence, not a hosted running-artifact claim. The approved contributor runtime pins remain unchanged. Reproducibility #7043 and Bitkey Wallet stay independent.Resulting app behavior
newRevision; 409/404/malformed/missing/lost/timeout responses stop remaining members, with no legacy fallback or ciphertext replay. An independent later read-only comparison can establish a new baseline.Historical Cloud evidence (original d25/b600 source proof)
The original Cloud source proof tested implementation
3cc9368ca2f3b2149db5743a5f9d230aa516d6a0, then documented it at d25. The current fb9 head also has targeted Android login, isolated iOS pod/Hermes and paired Relay test-pin fixes; exact-head Local reruns and native validation are recorded separately below. The final 260-case run uses a fresh Relay checkout installed with its frozen Yarn lockfile, reproducing the corrected hosted dependency setup. CodeQL findings in existing email/account parser utilities are fixed with bounded-input and real BIP32/KeyUID compatibility tests; normal signer identity functions remain unchanged. Per-scenario proof and provenance and open requirement matrix preserve actual boundaries.npm run test:automatic-backup-genuinewith Node22.23.3, native encrypted Realm and pinned transactional loopback Relaynpm run test:recoverynpm test -- --runInBand --coverage=falsenpm run test:releasetsc --noEmitnpm run release:preflightThe fixture loads actual Realm/schema/storage/snapshot/crypto/automatic/transport code, real reducers/origin/store observer statements and actual Relay routes/services/Mongoose transactions. Seven added cases use actual Redux Persist reconciliation/subscriber timing over disclosed host storage, preserve native recovery data, check canonical consent and persistence metadata, require real encrypted readback for fresh proof, and execute the exact status screen phase declarations against that proof. This last check is source-expression evidence, not rendered React Native UI. It does not replace iOS/Android app boot, MMKV, provider acceptance or physical signers. Independent agent fixture/source review found no additional blocking defect; that is not human PR approval. Hosted checkout used generated PR merge879009d36f4efd0ba7c46be134293017f8475a2f; its entire Git tree was verified identical to the then-head d25d566. Direct Cloud runs used code3cc9368; fb9 exact-head evidence is reported in the new Local validation.
Remaining release blockers
74df55446d8645ebfac05405fce81fa43446acd9, with its historical failed live-network run retained. Final test-only follow-up163cccb831f824b3daacc05199421683abdaf1adhas green hosted Tests and separate CodeQL: 35 suites/341 Jest, 210 recovery with zero skips, 12 Node+7 Python release checks and source-version consistency. Runtime/native/dependency trees remain identical to d280. Its earlier seven Electrum failures and subsequent wrong-key AES assertion failure are preserved in R4: harden wallet sync, Testnet faucet, links, and Ask Keeper #7042. The six substantive source approvals remain to be resolved. No source stack was merged or retargeted through an unapproved baseline.Remaining R4 gates and separate deliverables
The previous completeness audit is retained below. This continuation rechecked the unchanged source heads and current checks, Relay #4, Desktop #100 and website #19. It does not mark the complete R4 scope delivered from Cloud fixtures.
All 20 scope rows 5, 6, 14, 24, 193, 223, 224, 232, 240, 241, 243, 249, 252, 253, 254, 257, 258, 259, 260, 261 plus governing row 245 were reconciled. None is dropped or marked delivered from assembly/unit CI.
74df55446d8645ebfac05405fce81fa43446acd9; its production src/native/dependency trees are unchanged from d280, and current own-head Tests/CodeQL pass at final test-only source head163cc; source histories and tolerated ESLint failures remain explicit. Document conditional cloud review and optional human review #7034 conflict is resolved at2b55b6e9c5630628bacacc43191616d7f5b03797; one verification retry passed 183/183 on that unchanged documentation-only head. Its initial wrong-key assertion failure (1/183) and inherited nondeterminism remain disclosed; no tests/runtime code were imported into policy scope.ef050663d33be51f25fb10310d5a0549b111e273is approved and frontend/hosted tests passed, but current Mac UI/hardware and reviewed production signing/notarization/publication remain. Website Add accounts functional #19 is nowcfe7b15631cd71c827cd1c78096fe30295e75acd: the development association package matches the actual Gradle/debug certificate; 4/4 local tests and exact-head association CI pass; direct live association/remote paths still 404. Approval, separately authorized hosting, actual 2.6.4/Play signing fingerprints and installed iOS/Android round trips are open. Fresh Local handoffs are posted on both PRs.d4d59b080370637ac82e3a7cf6ef58564f9a22ac; current hosted checks pass, runtime pin remains approved ee935359. SigningServer Login with Face ID and a pin. #1/Add a Wallet. #2/Secure with Hexa Keeper. #5 unchanged approved heads passed an isolated unpushed integration compile + 127/127 tests. Source != deployment: staging replica/index/revision/generation/old-client restore, actual route authorization/log/provider/security inventory, running artifacts and independent contributor fork/Server Key acceptance remain open. Fresh operator handoffs are posted; no new Assisted Multisig server work pending Adam.2c3a0dc9dd8efc203bf9d85b5da21bf7adafbf58fixes a cross-realm fixture assertion and adds least-privilege pinned disposable Mongo CI. Fixture 38211807873 passed; Sonar Build 38211807713 still fails its server-version HTTP timeout. Administrator script is unchanged/unapplied. Independent review, fresh private production inspection, Atlas admin access, explicit operation approval and postflight remain. Tracker A253 still Soon; precise recommendation is Now, preserving all blockers. Sheet was not edited.outputs/r02-timelock-preserved-before-scope-trim-2026-10-02assessor/34-test evidence is unavailable in Cloud. Current prevention tests do not implement existing-wallet assessment. Recover original provenance for a separately reviewed read-only port; independent initial-lock intent and any later consented funded migration remain open. No detector/repair was invented or real wallet touched.Exact Local instructions
Safe commands and complete Local acceptance resolve and verify the live exact-head handoff before checkout. The paired fixture pin is immutable and separate from approved contributor sources. No owner app/data or real funded wallet may be replaced.
Codex local handoff
State: NEEDS_LOCAL
PR: #7045
Base: sprint
Head branch: codex/r4-264-combined-candidate
Head commit: 4927ad5
Goal and acceptance criteria: Validate the one authorized missing-producer correction in the ORIGINAL native order on both platforms: initially Verified/no nodes → ordinary Mobile Wallet detail autoRefresh creates defaults → automatic complete Verified/readback WITHOUT manual repair → ordinary rename → complete renamed readback and cold persistence. This does not claim the exact17e0 native cause was uniquely proved, change manual conflict behavior or complete R4. NOT RELEASE-READY.
Changes made: Exactly4app TypeScript files: src/store/sagas/network.ts, wallets.ts, send_and_receive.ts and src/store/store.ts. CONNECT_TO_NODE is stamped at dispatch; four direct callers retain original origin/session/intent, including explicit missing authority. Worker retains original Realm/network/session before yielding, plans actual initial/fallback additions as ONE append-only atomic managed local commit, then spawn(updateAppImageWorker, updateNodes:true, original receipt/account/session). This preserves every persisted custom/mixed-network node, existing IDs/fields, completed fallback-deletion markers and no-op behavior. Detached backup does not hold Electrum/refresh/faucet/send parent completion. Existing proof/consent/generation/fingerprint/original-revision/CAS/readback guards stay intact; no rebase/retry/observer upload. Also changed3test files (new20case genuine matrix, optional actual network reducer fixture support, relevant Jest unit adapter) and2evidence/handoff files:9files total.
Cloud checks: PASS full npm run test:automatic-backup-genuine295/295,0fail/skip/cancel,213482.007654ms, including actual native write/read prerequisite; Node22.23.3/Linuxx64/Realm12.15.0 and clean paired Relay838049e537e07eb646a2a0393eb969fba43d0739. New20cases all passed in that full run; initial focused19/19 plus last Realm-handle1/1 separately. Accepted unchanged9a19 actual-caller RED0/1,0skip: actual local defaults/migration flags, expectedCAS1/actual0; preserved before source edit. Realflags/background test holds genuine HTTP snapshot, proves provider and parent finish while backup pending, runs both actual Realm isConnected updates without advancing recovery generation, then complete Verified; settled reconnect0native transactions/0HTTP. PASS recovery448/448,0skips,53687.300236ms; Jest42suites/432tests,58.513s (focused existing connection3/3); release components28Node+7Python+21Ruby/117assertions,0failure/skip; version2.6.4/Android627/iOS620 (provisional); network ESLint/diff/changed links. Independent read-only safety review of final production/tests: no blocking findings. Whole TypeScript FAIL944diagnostics on BOTH unchanged9a19 and final source; normalized added0/removed0 (path/code/message/multiplicity retained; locations and dependency symlink paths normalized). All4module ESLint still FAIL12inherited errors/17warnings in wallets/send, normalized added0; network/store are clean. Whole-project ESLint NOT RUN. New-head hosted CI is pending, not claimed passed. Android diagnostic run38681894775 CANCELLED while queued: final jobs API runner_id0/empty runner_name/steps[], no checkout/build/signing/artifact/upload steps ran (not a per-step skipped-status claim). New-head iOS/Android build/install/launch/UI/MMKV/hardware NOT RUN in Cloud.
Required local checks: IOS, ANDROID, HARDWARE
Local checks requested: Read managed producer proof and exact Local continuation, AGENTS.md, latest Local evidence and full R4 handoff; recheck live head. Preserve existing Local9a19 controls/checkout/state, failed17e0/9a19 artifacts/accounts and every earlier result. Only later advance an isolated clean checkout to this exact SHA. Incrementally rebuild Android developmentDebug and iOS simulator Debug, ACTUALLY install/launch both new artifacts, identify artifact/source/JS checkout/device/package/version/certificate/backend. On existing strict16KB Android17/API37 confirm PAGE_SIZE16384 and official established fatal/true properties; no compat mode. Run original-order fresh account opt-in→Verified with0nodes→ordinary Wallets/Mobile Wallet detail BEFORE editor/Save→automatic full Verified with defaults, no Back Up Now bridge. Then one ordinary harmless rename must update remote revision, native decrypted entire image+metadata match fresh Realm, only intended name delta, fresh StatusVerified. Reconnect/no-op must not upload again; cold PIN/MMKV/Realm must retain consent, nodes/name and truthful fresh proof. Retain relevant existing PIN/keypad/Portal/MMKV/Realm/wallet/backup/recovery base smoke on BOTH platforms. Local's staged full genuine matrix should target this exact source, not known-failed9a19. Keep other incomplete R4 categories tracked rather than repeat unrelated large native/static/provider matrices. Any remaining native failure: preserve and report actual evidence; no further speculative fix/rebuild loop under this handoff.
Risks / known gaps: Source is NEEDS_LOCAL, not native acceptance or release readiness. Native/build/dependency/configuration inputs are byte-identical to9a19: android/, ios/, package.json, yarn.lock, patches/, JNA5.18.1/Portal pins/exclusions, build counters, tracked config/templates, approved contributor manifest; backup automatic/transport/repair implementations and both readiness constants unchanged. Incremental caches may be reused, never old native passes. Old17e0 Android16KB/4KB/static/iOS compile and9a19 native healthy rename/cold/control results remain SHA-scoped. The original9a19 pre-edit bootstrap failure is preserved; healthy-baseline9a19 native rename/fullcrypto/cold PASS does not pass it.17e0 manual Needs Review is expected conservative same-ID-name protection/UX limitation, not a newly proved transport defect; no retry/override/manual guard change. C8/#7056 stays owner-parked and failed. All remaining full R4 acceptance, independent review, backend source/fleet/index/transactions/old-writer and authorized rollout, fresh store/config/counter inputs, signed/distributed artifact proof and separate Desktop/website gaps remain. A fresh owner exact-SHA decision is required to defer only unrun physical HARDWARE; old9a19 scope does not transfer; IOS/ANDROID and failures cannot be waived. No merge/deploy/index creation, release signing, production AAB/split construction, upload/submission/publication, real/paid provider call, customer message or transaction. Independent of Reproducibility/Bitkey Wallet.
Provenance, initial failures and reproducibility
Paired Relay stays clean838049; approved contributor sources.lock.json remains unchanged. Disposable loopback Mongo7.0 keeperQA:27058 uses mongo:7.0@sha256:9854f7139445d766a9523571d6f047530c45547460ffcf8259eb2bf4264632ca. Actual native realm.node SHA256 f9873520422ba77488708a7ef760b189117782a9b13ae1f5c963a68041965934. Public Electrum/provider boundary is stubbed/disclosed, fee actions not serviced; production node module/origin middleware/observers/encrypted native Realm/crypto/HTTP/CAS/readback are real. No rendered UI/MMKV/public-provider acceptance is inferred. Ruby3.3.8 rule tests ran offline/read-only in pinned ruby@sha256:307aed56240959e9cd3fcc10740ae8d0e6c461e9b42efc076100d4f8126b87b9, not real Fastlane actions.
Initial Mongo-not-primary before-hook failure was a prerequisite failure, NOT acceptedRED. An empty cross-VM object assertion was normalized to plain data before acceptingRED. Final20thcase initially tried simultaneous cached same-path Realm wrappers and hit closed-Realm setup failure; corrected only its setup to actual close→reopen same account/session, then1/1 and full295/295 passed. No app lifecycle fix was made or Mac reproduction claimed. Accepted unchanged9a19 network source SHA256744c69af7633e8ac4333b535c76f50dc76e34e2eae4b469d7c85826c86e8700e; REDlog SHA2568cbeec9e557cc4f6e8343b91113ad929cf950060c844201e8c2993c165d301b7. Committed first test plus optional fixture network reducer are portable reproduction source; exact commands/toolchain/initial failures are in the linked evidence. Earlier17e0 diagnostic3/3 and separateRED0/1, and9a19 queue275/275, remain preserved separately.
Copy-ready Local prompt
Local gate
The draft remains NEEDS_LOCAL until actual collaborator-attested exact-head results satisfy the repository gate. A Local pass does not authorize merge, signing, deployment, upload, publication or customer communications.