who_need_help/android/play-store/internal-release-v4.md

2.8 KiB

Internal testing release v4

This operator record identifies the Android build currently available through Google Play Internal testing. It records observed artifact, Console, and physical-device evidence without authorizing a Closed or Production rollout.

Release identity

  • Track: Internal testing only
  • Release label: 0.1.3 Reliable notifications
  • Package: org.whoneedhelp.mobile
  • Version code: 4
  • Version name: 0.1.3
  • Source fingerprint: 42b485964a8c3fdaeff94ca80dcd8f33533e1723c6c2d625a9483458c0ff0068
  • AAB: android/dist-release-20260821-v4-precommit/who-need-help-release.aab
  • AAB SHA-256: 5147404e91aee6ef87014e19db93403fdb18a15e91b749737c494c372ea87371
  • Companion APK SHA-256: 58136ea5ddead7ee683f28f3ae12aa65334207c40ebfe2fdb34064b8d2710c3d
  • Upload-certificate SHA-256: a5742bae70c6d034e37544b62e37a375c0e005647450f40f29b2a984f9fdb8fb

The artifact directory name is accurate: the build was produced before its matching Android source state was committed. Historical checkout comparison found f15f5578e010df80a430f2dbfa4aca54face65f3 to be the first committed revision whose Android build-input fingerprint exactly matches the retained artifact. This is reproducibility evidence; it is not a claim that the artifact was originally built by checking out that commit.

Do not upload a different artifact under this release record. Any Android source or build-input change requires a new version code, a fresh source-bound build, and a new operator record.

Publication evidence

A read-only authenticated Play Console inspection on 2026-08-25, repeated on 2026-08-26, showed:

  1. Internal testing is active;
  2. the latest release is 0.1.3 Reliable notifications with one version code;
  3. the release is available to internal testers;
  4. the Console displayed a release time of 2026-08-25 3:46 PM;
  5. the app remains unreviewed, so Internal testers see the temporary package name;
  6. the existing Closed testing - Alpha track is inactive, has zero of four setup tasks complete, has no countries or testers selected, and contains no release;
  7. no Production rollout was observed or started during the inspection.

Play-delivered physical-device evidence

The authorised physical phone passed the strict delivery-boundary verifier:

./scripts/verify-play-installed-android.sh \
  output/runtime/production-provider-setup/play-identities.json \
  72551e60 \
  4 \
  0.1.3

The verifier observed package org.whoneedhelp.mobile, version 0.1.3 (4), Google Play as installer, a signing identity in the protected Play App Signing set, and a verified whoneedhelp.com App Link resolving to MainActivity. The browser-only Google OAuth callback was not claimed by the Android application. The verification was read-only and did not install, update, clear, or reconfigure the app.