Complete native iOS flows, adaptive UI and repository hardening

.gitignore

@@ -15,3 +15,18 @@ google-services.json
 *.mobileprovision
 *.xcresult/
 __pycache__/
+/validation-device.json
+/TestAttachments/
+/build.log
+/SourcePackages/
+/release-build.log
+
+# Private deployment inputs; templates remain reviewable.
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+*.pfx
+/dependency-lock-validation.json
+/build-tools.json

AGENTS.md

@@ -16,3 +16,30 @@
    A phase with failing or skipped tests is not done.
 6. Secrets: none in the repo, ever. No analytics or third-party SDKs beyond §6 without asking.
 7. Accessibility and dark mode are part of "done" in every phase, not a final polish pass.
+
+## Branch delivery workflow
+
+The owner merged the A0 foundation and subsequently updated the delivery workflow:
+
+- Start ongoing work from `dev`, commit there, and push to `origin/dev`.
+- Consolidate on `dev` without new feature branches or pull requests. The owner's latest instruction uses the already-open iOS [pull request #4](https://github.com/SpaceWorks-HQ/SpaceWorks-iOS/pull/4): after the required repository native/CI, unsigned Release and actual visual gates pass, merge that exact reviewed head into `main` through the existing pull request. Keep `dev` and preserve phase commits.
+- Retire obsolete work branches only after their work is safely retained. Preserve the owner's configured commit identity and the required Codex co-author trailer.
+
+## Complete-build execution addendum (owner, 2026-10-16; delivery updated 2026-10-18)
+
+The owner requested the remaining phases as one batch, with Android and iOS agents in parallel.
+Implement each phase sequentially on `dev`, with phase commits, tests, CI evidence, and a changelog
+parity checklist. A green phase may proceed without an intermediate merge. Consolidate the batch
+on `dev`, complete the required repository validation and actual visual review, then merge the tested
+work into `main` through the already-open iOS pull request #4 under the owner's latest instruction.
+Keep `dev` and phase commits; do not create another pull request or feature branch for this batch.
+Follow the branch delivery policy above. Preserve `docs/PRD.md`
+byte-for-byte.
+Phone and tablet layouts, portrait/landscape, light/dark and largest Dynamic Type are now in scope.
+Use generated contract operations only. Record missing backend contracts as `backend-request`
+issues and continue independent work when prerequisites permit. Local Docker is the development API;
+development attestation and local HTTP must remain Debug-only. Store credentials only in Keychain.
+
+Mobile-specific onboarding/auth UX and motion belong in `docs/mobile-auth-ux-spec.md` and
+`tokens/mobile-motion.json` in this repository. Do not push mobile implementation/spec additions
+to the Design repository. The Design submodule supplies the existing brand masters and colors.

CONTRIBUTING.md

@@ -0,0 +1,34 @@
+# Contributing
+
+Read [AGENTS.md](AGENTS.md), the immutable [PRD](docs/PRD.md), the current phase notes and
+[release handoff](docs/RELEASE-READINESS.md) before changing behavior. Follow the owner's current
+branch/PR instructions; do not create another delivery PR for the current batch.
+
+Use the pinned Design submodule and supplied OpenAPI contract. Server calls and payload models
+belong to the generated client. Report missing contracts rather than inventing endpoints, successful
+payments, deletion or access. Keep credentials and personal data out of code, fixtures and logs.
+Use private reporting for security issues; see [SECURITY.md](SECURITY.md).
+
+On a Mac with the reviewed Xcode/generator versions:
+
+```sh
+git submodule update --init --recursive
+python3 scripts/check_build_tools.py
+python3 scripts/generate.py
+python3 -m unittest discover -s scripts/tests -v
+python3 scripts/lint.py
+xcodegen generate
+python3 scripts/dependency_lock.py stage
+```
+
+Use the exact native commands and simulator signing configuration in the release guide. Retain the
+reviewed lock and no-automatic-resolution flags documented in [Dependencies](Dependencies/README.md).
+Generated Swift, assets, entitlements and Xcode projects are not source edits. A dependency/toolchain
+change requires explicit graph review and fresh native/Release proof; do not update versions implicitly.
+
+Preserve native navigation, semantic branding, Dynamic Type/Bold Text, VoiceOver, Reduce Motion,
+session ownership and cancellation. Test affected behavior without removing required cases or
+pretending Windows source checks establish a SwiftUI build. Preserve exact source/run/artifact
+provenance and actually inspect required full-OS captures. Fixture/demo results never establish
+backend delivery or signed real-device behavior. Use small phase commits with the configured
+owner identity and the required Codex trailer for Codex-authored changes.

Dependencies/README.md

@@ -0,0 +1,33 @@
+# Reviewed build dependencies
+
+`Package.resolved` is the unmodified Xcode lock exported from actual source
+`47e1880a5c7fe549608e2a38cba789d47cf152dc`, focused run
+[39100123222](https://github.com/SpaceWorks-HQ/SpaceWorks-iOS/actions/runs/39100123222),
+artifact 12125599794. SHA-256:
+`4a0c17f8dbe46c87952310b079a07b89481d715af79b17a2d164581e7b7b2aa0`.
+Its 20 version/revision pins include the direct and transitive app/code-generator dependencies.
+The package/project declarations were unchanged at `775f298`. This provenance is an actual focused
+build, not a claim that the old source passed complete final validation.
+
+Following [Apple's CI guidance](https://developer.apple.com/documentation/xcode/building-swift-packages-or-apps-that-use-them-in-continuous-integration-workflows),
+after generating the Xcode project run `python3 scripts/dependency_lock.py stage`.
+Xcode builds use `-disableAutomaticPackageResolution -onlyUsePackageVersionsFromResolvedFile`.
+`python3 scripts/dependency_lock.py check` rejects any byte change to the resulting workspace lock.
+CI caches include the canonical lock's hash and archive both the observed lock and verification.
+The generated project remains ignored; do not commit a generated Xcode project to retain the lock.
+
+For an intentional dependency update, change the declared exact versions, resolve explicitly on
+the pinned Xcode installation in a reviewed development checkout, inspect every changed version,
+revision and upstream repository, then replace this canonical lock. Run the complete source/native,
+device-profile and unsigned Release/resource gates. Never accept an automatically rewritten lock,
+silently update a package, or treat an SDK compile as live provider/backend verification.
+
+`build-tools.json` records XcodeGen 2.46.0 and librsvg 2.62.3 from the actual published installation
+log. CI checks these versions after installation and records actual executable version output;
+it fails closed if a future Homebrew install selects a different version. This does not promise
+that Homebrew will retain an older formula. Review a deliberate toolchain update and its generated
+assets instead of upgrading the expected version merely to make a check pass. Xcode 26.2 remains
+the separately pinned Apple toolchain.
+
+Dependencies and supplied fonts/assets retain their own applicable licenses. This file grants no
+additional license or embedding rights and does not choose an application repository license.

Dependencies/build-tools.json

@@ -0,0 +1,12 @@
+{
+  "versions": {
+    "xcodegen": "2.46.0",
+    "librsvg": "2.62.3"
+  },
+  "provenance": {
+    "source_sha": "47e1880a5c7fe549608e2a38cba789d47cf152dc",
+    "run": 39100123222,
+    "job": 117594513500,
+    "evidence": "Published Install project and icon generators job log; Cellar version paths. Same versions also appear in the 775f298 full-phone prefix."
+  }
+}

Fixtures/Account/archive.json

@@ -0,0 +1,3 @@
+{
+  "base64": "UEsDBBQAAAAAAABIUF2EsZAMUAAAAFAAAAAKAAAAUkVBRE1FLnR4dFNQQUNFIFdPUktTIERFTU8gRVhQT1JUClNhbXBsZSBkYXRhIG9ubHkuIE5vIHBlcnNvbmFsIGFjY291bnQgZGF0YSBpcyBpbmNsdWRlZC4KUEsBAhQAFAAAAAAAAEhQXYSxkAxQAAAAUAAAAAoAAAAAAAAAAAAAAIABAAAAAFJFQURNRS50eHRQSwUGAAAAAAEAAQA4AAAAeAAAAAAA"
+}

Fixtures/Account/challenge.json

@@ -0,0 +1,6 @@
+{
+  "challenge": "demo-account-challenge",
+  "enrollment_required": true,
+  "expires_in": 300,
+  "mfa_required": true
+}

Fixtures/Account/export.json

@@ -0,0 +1,12 @@
+{
+  "completed_at": null,
+  "created_at": "2026-10-16T09:00:00Z",
+  "expires_at": "2099-01-01T00:00:00Z",
+  "failure_code": "",
+  "failure_detail": "",
+  "id": "84000000-0000-4000-8000-000000000001",
+  "manifest": {
+    "demo": true
+  },
+  "status": "available"
+}

Fixtures/Account/grants.json

@@ -0,0 +1,22 @@
+[
+  {
+    "app_id": "org.spaceworks.app",
+    "attested_at": "2026-10-16T09:00:00Z",
+    "created_at": "2026-10-16T09:00:00Z",
+    "environment": "development",
+    "id": "83000000-0000-4000-8000-000000000001",
+    "last_used_at": "2026-10-16T09:00:00Z",
+    "platform": "apple",
+    "status": "active"
+  },
+  {
+    "app_id": "org.spaceworks.app",
+    "attested_at": "2026-10-16T09:00:00Z",
+    "created_at": "2026-10-16T09:00:00Z",
+    "environment": "development",
+    "id": "83000000-0000-4000-8000-000000000002",
+    "last_used_at": "2026-10-16T09:00:00Z",
+    "platform": "android",
+    "status": "active"
+  }
+]

Fixtures/Account/membership.json

@@ -0,0 +1,4 @@
+{
+  "renewal_cancelled_at": null,
+  "status": "active"
+}

Fixtures/Account/mfa.json

@@ -0,0 +1,5 @@
+{
+  "available": true,
+  "enabled": true,
+  "required": false
+}

Fixtures/Account/provider.json

@@ -0,0 +1,5 @@
+{
+  "created_at": "2026-10-16T09:00:00Z",
+  "provider": "google",
+  "updated_at": "2026-10-16T09:00:00Z"
+}

Fixtures/Account/recovery.json

@@ -0,0 +1,7 @@
+{
+  "recovery_codes": [
+    "demo-recovery-01",
+    "demo-recovery-02",
+    "demo-recovery-03"
+  ]
+}