Skip to content

Prepare exact app notice capture and incomplete discovery gates - #220

Draft
patrickchin wants to merge 34 commits into
codex/font-icon-noticesfrom
codex/app-notices-capture
Draft

patrickchin wants to merge 34 commits into
codex/font-icon-noticesfrom
codex/app-notices-capture

Conversation

@patrickchin

@patrickchin patrickchin commented Nov 14, 2026 •

Copy link
Copy Markdown
Owner

DRAFT / MERGE HELD. The offline payload still contains reviewed font/icon text only. The component-approval ledger is empty, overall notice coverage remains INCOMPLETE, and strict sealing remains blocked.

The current reviewed source is 82cede4b492a75a69bfbc9b4c27e3efb735b814c, an ordinary fast-forward from 88fa985db7a43276533b959badde0f129c0293cc. Root and independent source reviews are clear; all54 affected Node tests pass. The six-file tail preserves all110 prior registry records and all other provenance values, payload, assets, workflows, dependencies, product and native configuration.

Six exact npm own-text records supplement missing MIT text with three manually reviewed immutable upstream files. Package manifests, selected files, original text and lock version/tarball/integrity are revalidated. Publisher metadata is a reviewed declaration in the fingerprint, not a claim that capture fetched or authenticated remote metadata.

Three explicit Pod records now preserve own attribution: Yoga uses the existing strict selected-package binding and original react-native/LICENSE; ExpoRouter and ExpoUI reuse the strict own-text validator and reviewed Expo MIT text. Every capture reparses its actual Pod lock and requires the exact path form, canonical installed owner, expected version and pinned podspec. Finite selector evidence and the hash of the SAME parsed lock bytes enter those components' nativeInputs. Historical selector summaries cannot supply a binding. Unknown siblings/versions gain none; changed roots/forms/owner/spec/lock/text fail closed or remain unresolved. Tests cover public bodies, vendor boundaries, fingerprint drift and actual source-seal recapture.

Own attribution does not approve any component, vendor, generated input or retained native resource. ExpoFileSystem's three framework boundaries remain separately unresolved. No main merge, seal, complete SDK coverage, native artifact compatibility, provider acceptance or release qualification is claimed.

The prior 88fa iOS notices-only discovery passed dependency setup/collection with all app/account/runtime jobs skipped. Its finite selector evidence established the three actual path forms and matching owner/spec hashes; its explicitly INCOMPLETE inventory and all prior failure evidence retain their original source scope. The next authorized activity is exactly one iOS notices-only discovery on the current reviewed head after normal checks and fresh guards. Only fixed sanitized metadata and pinned public notice text may be collected; raw logs/maps/caches/private inputs and owner data remain excluded. No Android repeat or app compilation is authorized.

patrickchin and others added 11 commits November 15, 2026 02:52
* Require semantic arrival after skipping poop windows

* Keep retry tap bound to the source page label

---------

Co-authored-by: Patrick Chin <1392122+patrickchin@users.noreply.github.com>
* Fix signing-proof SDK bootstrap and pin equivalent driver inputs

* Accept only the expected missing-package exit in signing QA

---------

Co-authored-by: Patrick Chin <1392122+patrickchin@users.noreply.github.com>
Co-authored-by: Patrick Chin <1392122+patrickchin@users.noreply.github.com>
* Install emulator host runtime and diagnose missing libraries

* Keep SDK ELF diagnostics advisory to the real launcher

---------

Co-authored-by: Patrick Chin <1392122+patrickchin@users.noreply.github.com>
Co-authored-by: Patrick Chin <1392122+patrickchin@users.noreply.github.com>
Co-authored-by: Patrick Chin <1392122+patrickchin@users.noreply.github.com>
* Bound Android root readback and owned emulator cleanup

* Recognize exact SDK headless QEMU exec

---------

Co-authored-by: Patrick Chin <1392122+patrickchin@users.noreply.github.com>
Co-authored-by: Patrick Chin <1392122+patrickchin@users.noreply.github.com>
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Nov 14, 2026 •

Copy link
Copy Markdown

Deploying puptime with  Cloudflare Pages  Cloudflare Pages

Latest commit: 82cede4
Status: ✅  Deploy successful!
Preview URL: https://ce411215.puptime.pages.dev
Branch Preview URL: https://codex-app-notices-capture.puptime.pages.dev

View logs

patrickchin and others added 3 commits November 15, 2026 05:17
* Record finite Android signing exercise stages and failures

* Describe exercise evidence without stale preflight scope

---------

Co-authored-by: Patrick Chin <1392122+patrickchin@users.noreply.github.com>
@patrickchin patrickchin changed the title Prepare committed app notices and fail-closed capture checks Prepare exact app notice capture and incomplete discovery gates Nov 14, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant