Document Google Play internal v2 verification

android/play-store/internal-release-v2.md

@@ -0,0 +1,33 @@
+# Internal testing release v2
+
+## Play Console values
+
+- Package: `org.whoneedhelp.mobile`
+- Version: `0.1.1 (2)`
+- Release name: `0.1.1 App Links routing fix`
+- Track: Internal testing only
+- Source commit: `510ad2898c2131b493659963a069a0c8b868c2fb`
+- AAB: `android/dist-release-20260809-072143-v2/who-need-help-release.aab`
+- AAB SHA-256: `e5a731ce2360f0ba907b4d23e9416cf0a1db8627642e1a11205de780d05dabf8`
+
+## What changed
+
+The application still opens supported public Who Need Help routes as verified
+App Links. OAuth provider callbacks and other browser-only routes are excluded
+from the Android claim, so Google can complete its browser callback before the
+site returns control to the authenticated application.
+
+## Observed result
+
+The build was installed by Google Play on the physical test phone. The strict
+installed-build verifier passed the version, installer, Play signing identity,
+verified domain, supported App Link and excluded OAuth callback checks. Google
+sign-in, FCM delivery and tap routing, consent-based foreground location,
+background sampling, notification stop action, raw-position removal and the
+native offline screen were then exercised successfully.
+
+Detailed evidence and remaining gates are recorded in
+`docs/google-play-release-candidate-2026-08-09-v2.md`.
+
+Do not promote this build to Closed or Production solely because the Internal
+testing verification passed.

docs/google-play-release-candidate-2026-08-09-v2.md

@@ -0,0 +1,90 @@
+# Google Play internal release candidate v2 — 2026-08-09
+
+This record binds the second Google Play Internal testing build to the exact
+source and verification evidence observed on 2026-08-09. It is evidence for an
+internal pilot only; it is not evidence of Closed testing completion or a
+Production-track rollout.
+
+## Source and artifacts
+
+- Source commit: `510ad2898c2131b493659963a069a0c8b868c2fb`
+- Source fingerprint: `008ccf3dbb480dcbdb2962cf0d218ab4508fca6284c2dd2879c327931551b749`
+- Package: `org.whoneedhelp.mobile`
+- Version: `0.1.1 (2)`
+- Internal release name: `0.1.1 App Links routing fix`
+- AAB SHA-256: `e5a731ce2360f0ba907b4d23e9416cf0a1db8627642e1a11205de780d05dabf8`
+- Release APK SHA-256: `1e4b783a801829a21e59709a06464d3d1de8c96f260d204b92ddb745d34ce598`
+- Universal APK SHA-256: `1bd128b9c0ad3bd4ca890e7390f9f31b281c303a04926f20fb12f09885bb2e6b`
+- Universal APKS SHA-256: `246270e0d8fe14f9c619613d422f08de9f76c4df945625ae501aeb3ca923a888`
+- Local artifact directory: `android/dist-release-20260809-072143-v2/`
+
+The Android unit tests, lint, release build, bundle validation and repository
+quality gate passed before this record was written. Google Play accepted v2 on
+the Internal testing track. No Closed or Production release was created by
+this verification.
+
+## Play-delivered installation
+
+The connected physical device reported:
+
+- version `0.1.1 (2)`;
+- installer `com.android.vending`;
+- a signing identity contained in the recorded Play App Signing set;
+- verified domain state for `whoneedhelp.com`;
+- `/safety` resolved to `MainActivity`;
+- the browser OAuth callback was not claimed by `MainActivity`.
+
+The exact verifier output is retained at
+`output/android/play-v2-installed-verifier.txt`.
+
+## Physical workflow evidence
+
+The Play-delivered v2 build completed all of the following against production:
+
+1. Google sign-in returned from the native account chooser to an authenticated
+   application session.
+2. A scoped FCM notification was delivered with the privacy-safe title
+   `Help completed`; tapping it opened the in-app Notifications inbox.
+3. A verified App Link opened the exact scoped request.
+4. Location permission started denied. The application showed its prominent
+   disclosure before Android's foreground-location permission dialog.
+5. After consent, Android reported the foreground `TrackingService` and the
+   ongoing `Sharing live location` notification with a `Stop sharing` action.
+6. Sampling continued after the application was minimized. Production retained
+   one current position while sharing was active.
+7. Stopping through the system notification removed the foreground service and
+   notification. Production then retained zero raw positions.
+8. A cold start without connectivity showed the native offline screen stating
+   that private pages are not saved on the device. Connectivity was restored
+   to its original state.
+9. A later force-stop and verified App Link restart returned to the authenticated
+   request without restarting sharing.
+
+Screenshots and UI dumps are retained under `output/android/` with the
+`play-v2-` prefix. These artifacts are local and intentionally excluded from
+Git.
+
+## Scoped production cleanup
+
+The notification replay deleted exactly its one notification and two related
+Oban jobs. The location replay deleted exactly its one synthetic requester,
+request, assignment and tracking session. Follow-up checks found no remaining
+fixture user, request, tracking service or tracking notification. Production
+readiness still returned `{"status":"ready"}`.
+
+The frozen hackathon test deployment remained on commit
+`cf7bacd61` and was not changed. The public Git remote was not pushed.
+
+## Remaining release gates
+
+Before advancing beyond Internal testing, complete and recheck in Play Console:
+
+- store listing, category, tags and required graphics;
+- App access instructions and support contact;
+- Privacy Policy, account-deletion URL and Data safety answers;
+- ads, target audience and content-rating declarations;
+- foreground-service/location declaration and its required demonstration;
+- Closed testing with the currently applicable Google Play eligibility rules;
+- a fresh source-bound AAB for any code change after this candidate.
+
+No Production-track rollout should be inferred from this document.

docs/verification.md

@@ -2482,3 +2482,29 @@ promoted.
 - This verification changed only the local checkout. The public Git remote,
   production deployment, and frozen hackathon test deployment were not
   changed.
+
+# 2026-08-09 Google Play internal v2 physical verification
+
+- Google Play installed `org.whoneedhelp.mobile` version `0.1.1 (2)` from the
+  Internal testing track. The installed-build verifier observed installer
+  `com.android.vending`, a recorded Play App Signing identity, verified
+  `whoneedhelp.com` domain state, supported App Link resolution to
+  `MainActivity`, and exclusion of the browser OAuth callback.
+- Production Google sign-in, scoped FCM delivery and tap routing were exercised
+  on the physical phone. The exact notification and its two related Oban jobs
+  were deleted and individually verified absent afterward.
+- The Play build displayed the prominent location disclosure before Android's
+  native permission prompt. Foreground sharing continued while minimized,
+  exposed an ongoing notification with a stop action, and production retained
+  only one current position while active. Stopping removed the service and
+  notification and left zero retained raw positions.
+- A cold offline start displayed the native privacy-safe offline screen.
+  Connectivity was restored to its original state, and a later verified App
+  Link restart returned to the authenticated request without restarting
+  sharing.
+- The run-scoped requester, request, assignment and tracking session were
+  deleted and verified absent. Production readiness remained `ready`; the
+  frozen hackathon test deployment and public Git remote were not changed.
+- Exact hashes, screenshots, cleanup scope and remaining Google Play gates are
+  recorded in `docs/google-play-release-candidate-2026-08-09-v2.md` and
+  `android/play-store/internal-release-v2.md`.