107 lines
5.0 KiB
Markdown
107 lines
5.0 KiB
Markdown
# Google Play Internal candidate v3 — 2026-08-09
|
|
|
|
This record binds the third Internal testing release to the exact committed
|
|
source and observed verification evidence. Google Play accepted, released, and
|
|
delivered this exact artifact on the Internal testing track on 2026-08-10.
|
|
|
|
## Source and artifacts
|
|
|
|
- Source commit: `cd154766a06bb1febb0598fb3f53db78628bd7f6`
|
|
- Source fingerprint:
|
|
`70529d3befcb0818f0b79f7869389b4fad432eb2911be08d52342529b7f22614`
|
|
- Package: `org.whoneedhelp.mobile`
|
|
- Version: `0.1.2 (3)`
|
|
- Intended Internal release label: `0.1.2 Location consent clarity`
|
|
- Artifact directory: `android/dist-release-20260809-v3/`
|
|
- Release APK SHA-256:
|
|
`32132ee85b58e2f719b11d004dd7f5896bfde3b01372ad0b3293bf7bcbe79193`
|
|
- Play AAB SHA-256:
|
|
`5f1b63d02467ce63af795d16459a75693e415426478e0788b83f0f6d35dff922`
|
|
- Universal APK SHA-256:
|
|
`b2bcb19d96c42621a5001a6b682edcb6d27aa3932ec334f0e93b0b7f20817393`
|
|
- Universal APKS SHA-256:
|
|
`b7024006c27c5d4878cad95b8c9dc2eb2e1038aa713c9dbf719a51eccfa1a497`
|
|
|
|
The build used a temporary mode-0600 copy of the production Android
|
|
configuration with only the candidate version changed to `0.1.2 (3)`. The
|
|
temporary file was removed by the isolated build unit. The development `.env`,
|
|
production server and frozen hackathon test deployment were not changed.
|
|
|
|
## Release pipeline evidence
|
|
|
|
The source-bound release pipeline completed successfully:
|
|
|
|
- production Android environment and App Links identity validation;
|
|
- release unit tests;
|
|
- release lint;
|
|
- R8 code shrinking and resource shrinking;
|
|
- release APK and AAB assembly;
|
|
- APK signing-certificate verification;
|
|
- AAB JAR-signature verification;
|
|
- bundletool AAB validation and universal APK generation;
|
|
- package-name and production-origin verification;
|
|
- exported source fingerprint comparison with the current committed source.
|
|
|
|
The isolated build unit was
|
|
`codex-heavy-wnh-android-release-v3-20260809-20260809-211532-3613142.service`.
|
|
It completed successfully in 37.450 seconds with a 154 MiB unit memory peak;
|
|
Docker build workers are accounted for by the Docker service rather than this
|
|
client unit.
|
|
|
|
## Instrumentation evidence
|
|
|
|
The current source passed API 37 instrumentation in the isolated unit
|
|
`codex-heavy-wnh-android-instrumentation-api37-v3-20260809-211723-3671839.service`.
|
|
|
|
- Main instrumentation: `OK (10 tests)` in 71.145 seconds.
|
|
- The suite covered loading state, denied permission, web geolocation,
|
|
disclosure cancellation, App Link recreation/update, foreground location
|
|
posting and notification Stop, network retry, Home/activity destruction and
|
|
main-page retry.
|
|
- The process-death probe intentionally killed the instrumented app after the
|
|
foreground service appeared. The harness verified that the non-sticky
|
|
service and persistent notification did not remain.
|
|
- Evidence directory:
|
|
`output/android-instrumentation/api37-0/20260809181723-3672268/`.
|
|
- The generated emulator container, image and named AVD volume were absent
|
|
after cleanup.
|
|
|
|
## What changed from Play-delivered v2
|
|
|
|
Candidate v3 changes the live-location cancellation contract: dismissing the prominent
|
|
native disclosure or denying the permission emits an explicit cancellation
|
|
event instead of a generic technical-error event. The web UI can therefore
|
|
remain in the stopped state without falsely telling the user that location
|
|
sharing failed.
|
|
|
|
## Play delivery and remaining gates
|
|
|
|
On 2026-08-10 Play Console showed `0.1.2 Location consent clarity` available to
|
|
Internal testers with one version code. The physical phone's installed package
|
|
passed the strict Play installer, signing, exact-version, App Link, and activity
|
|
resolution verifier. A production-fixture replay also verified user-initiated
|
|
foreground location, minimized notification operation, notification Stop, 41
|
|
samples, zero retained raw positions after Stop, and exact fixture cleanup.
|
|
|
|
The final 21.379802-second foreground-location declaration video was recorded
|
|
from this Play-delivered candidate and verified locally and server-side. Its
|
|
path and SHA-256 are recorded in
|
|
`android/play-store/location-and-fgs-declaration.md`. It is hosted as an
|
|
unlisted YouTube Short at `https://youtube.com/shorts/UZh_QBdlbBc`, and the
|
|
authenticated Play Console foreground-service form was saved with
|
|
**User-initiated location sharing** and this URL. This does not claim Google
|
|
approval.
|
|
|
|
The remaining gates, rechecked read-only through 2026-08-26, are:
|
|
|
|
1. recheck the saved foreground-service declaration before submitting a new
|
|
bundle or release and respond to any Play policy feedback;
|
|
2. keep the public contact route monitored: Store settings contain
|
|
`contact@whoneedhelp.com`, and a controlled inbound test observed the exact
|
|
alias forwarding successfully to Gmail through ImprovMX. This verifies
|
|
receipt and forwarding, not a standalone mailbox or reply-from identity;
|
|
3. recruit the required tester cohort only after Closed testing is unlocked;
|
|
the Dashboard currently reports `0 testers currently opted-in`;
|
|
4. keep Closed and Production tracks untouched until their separate gates are
|
|
complete.
|