gowalk-cicd 1.0.145 → 1.0.147

package/CLAUDE.md

@@ -104,19 +104,20 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Detect and warn, tell the user to remove lines manually.
 - Never repeat an `env:` key in another case (`NO_PROXY` beside `no_proxy`): GitHub
   compares env keys case-insensitively and rejects the whole workflow or action file.
-  `test/env-keys.test.mjs` scans the templates and actions. Set lower-case spellings
-  or clear a lower-case bypass through `play_store_proxy.py -- <command>` (child
-  process) or `play_store_proxy.py --github-env` (later steps), never through YAML.
+  `test/env-keys.test.mjs` scans the templates and actions. Where a step genuinely needs
+  both spellings of a variable, set them inside the step's own child process, never in YAML.
 - Composite action steps cannot use workflow-only `timeout-minutes`. Native cache restores
   retain their segment timeout and the caller's job deadline; workflow-level cache steps
   can retain their two-minute step limits. `test/composite-timeouts.test.mjs` guards this schema boundary.
 - Store API calls belong in GitHub Actions. Local tests may build/sign but must
   never connect to App Store Connect or Google Play.
-- Every Apple/Google store API call, OAuth exchange and binary upload requires its
-  assigned `APPLE_STORE_PROXY_URL` / `GOOGLE_STORE_PROXY_URL` repository secret.
-  Python clients enforce explicit proxies; Play upload steps set the proxy for the
-  pinned Google client. Missing configuration must stop before a provider call.
-  Apple IPA uploads use `action/scripts/upload_build.py`, not native upload tools.
+- **GitHub Actions reaches Apple and Google directly, and must never be given a store
+  proxy.** The account-pinned residential exit exists so that the panel and the runner
+  Macs are not the hosts contacting the stores; a GitHub-hosted runner is neither.
+  No workflow, action or helper here may read `APPLE_STORE_PROXY_URL`,
+  `GOOGLE_STORE_PROXY_URL`, or set `HTTP(S)_PROXY` for a build tool — the job-wide
+  transport this replaced billed every SDK, pub, Gradle and CocoaPods byte to a metered
+  residential exit. Apple IPA uploads use `action/scripts/upload_build.py`, not native upload tools.
   It retains provider IDs/local SHA-256 and verifies matching IPA identity before resume.
   Finalization sends `uploaded:true` as Apple's documented BuildUpload flow does; the
   IPA endpoint rejected the optional SHA_256 checksum attribute despite the generic
@@ -143,51 +144,31 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   A certificate POST's HTTP 409 alone does not prove a full cap. `certificate_failure.py`
   emits fixed reason/code evidence in `apple_certificate_rejected`; raw provider details stay private.
   Certificate creation sends the complete PEM CSR in `csrContent`, including its framing and newlines.
-- Keep preinstalled Android SDK/NDKs. Every Gradle test/build and SDK download runs
-  under `play_store_proxy.py --`, whose owned loopback relay gives Java an explicit
-  authenticated account exit without credentials in JVM options. The child HTTP_PROXY
-  and HTTPS_PROXY variables also name the credential-free loopback relay because
-  Crashlytics Buildtools reads them first and rejects authenticated proxy URLs. HTTPS is tunneled
-  without TLS interception; no upstream failure may fall back to the destination.
-  Java bypasses the relay only for exact `localhost`, `127.0.0.1` and `[::1]`
-  targets so owned HTTP test fixtures remain local. Never widen that host list;
-  external requests and environment-first clients retain the assigned relay.
-  The wrapper disables Gradle daemons and closes its relay when the command ends.
-  The relay's idle deadline covers the whole tunnel: traffic in either direction
-  keeps downloads/uploads alive. An idle direction alone must never end a transfer.
-  A clean directional EOF forwards a half-close when the transport supports it and
-  leaves the opposite stream alive until completion, error or the shared idle deadline.
-  Never cancel an unfinished reply or upload merely because the other pump completed.
-- Flutter bootstrap is part of that boundary: before the Flutter setup action,
-  `play_store_proxy.py --bootstrap-env` validates the Google account pin and writes
-  both proxy/bypass spellings to the private job environment without console output.
-  SDK manifest/archive curl requests use that pin. Subsequent pub, analysis, tests,
-  localization, global activation and builds run through the existing owned relay.
-  The helper's bootstrap and command modes require only Python's standard library;
-  importing the Google API client must not become an unprotected bootstrap prerequisite.
+- Keep preinstalled Android SDK/NDKs. Gradle tests/builds, SDK downloads, pub, analysis,
+  localization and Flutter bootstrap all run with the job's own environment and reach their
+  providers directly. Do not reintroduce a relay, a wrapper shell or a proxy variable for
+  them: those existed only to force traffic through an account exit CI no longer uses.
 - `android-action/flutter-setup/` owns Flutter setup. It forwards the official action's
   inputs/cache identities while isolating restore/save from provider transport. Its step-local
   `NODE_OPTIONS` preloader (`android-action/scripts/cache_*.cjs`) also protects CocoaPods cache
   steps and verifies the exact pinned Actions cache entrypoint bytes and HTTPS
-  GitHub cache/Azure blob destinations before removing proxy variables in that cache process.
-  Unknown code or origins refuse; SDK setup, non-cache children and later steps retain their
-  proxy requirement. Never export this scope through `GITHUB_ENV` or add cache domains to
-  `NO_PROXY`. The preloader snapshot under `RUNNER_TEMP` also covers official post/save after
+  GitHub cache/Azure blob destinations before the cache process runs. Unknown code or
+  origins refuse. The preloader stays scoped to that one process: never export it through
+  `GITHUB_ENV`. The preloader snapshot under `RUNNER_TEMP` also covers official post/save after
   older consumer autoupdate changes the action directory. The installer delivers this development
   tooling for native iOS repositories too; it does not require an Android app.
 - Flutter manifest/archive GET recovery is scoped to the two pinned setup invocations through `BASH_ENV`.
-  It retains the account proxy and allows four attempts within 60 seconds for manifests or 20 minutes
-  for archives, with an 8 GiB archive bound. Interrupted archives resume private bytes with HTTP Range; an origin ignoring
+  It allows four attempts within 60 seconds for manifests or 20 minutes for archives, with an 8 GiB archive bound. Interrupted archives resume private bytes with HTTP Range; an origin ignoring
   Range permits a bounded full restart. Only complete JSON or an archive matching the selected official
-  manifest's SHA-256 enters action outputs. Proxy CONNECT 502/503/504 share that retry budget even
-  when curl exits 22 with origin status 0. Authentication/certificate refusals remain terminal.
+  manifest's SHA-256 enters action outputs. A transient origin refusal (408, 429, 500, 502, 503,
+  504) shares that retry budget. Authentication/certificate refusals remain terminal.
   `flutter_download_failed` emits fixed transport codes and retained-byte counts, never curl stderr.
   Archive progress emits retained byte counts every minute and safe results after each attempt;
   the transfer deadline leaves room for a failure receipt before a 30-minute validation job ends.
   With SDK caching enabled, failed archive transfers preserve public bytes in a job-owned,
   digest-scoped directory. Separate optional cache restore/save steps retain them between runs;
   they never expose partial bytes as an installed SDK. Successful or corrupt completed archives
-  are removed from that partial cache. Full SDK cache identities and provider transport stay unchanged.
+  are removed from that partial cache. Full SDK cache identities stay unchanged.
 - Web Release selects bundled renderer resources with `--no-web-resources-cdn` inside
   the existing proxied build command. This is not a font or integration offline guarantee;
   preserve app-authored font declarations, bootstrap configuration and other build inputs.
@@ -218,9 +199,8 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   only verified matching binaries with current credentials and retains the original build/symbol identity;
   a miss uses the normal build without waiting. Preserve successful sibling artifacts across reruns.
   See `docs/CANDIDATE_ARTIFACTS.md`; never turn this optimization into a new factory stage or resource reservation.
-  It reuses the cache transport's approved HTTPS request guard, then removes inherited proxy
-  variables only inside the official `upload-artifact` process. Unknown programs/origins refuse;
-  later Apple/Google clients retain their proxies and artifact failures remain job failures.
+  It reuses the cache transport's approved HTTPS request guard inside the official
+  `upload-artifact` process. Unknown programs/origins refuse; artifact failures remain job failures.
   The iOS action reads this helper from its immutable `SWIFT_APP_ACTION` snapshot. Its shared
   `cache_scope.cjs` and `artifact_env.cjs` copies match the Android distribution byte for byte,
   enforced by `test/artifact-wiring.test.mjs`; update both when changing that common guard.
@@ -266,12 +246,12 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   is the only place that decides which; every downstream step branches on the
   `project_kind` output rather than re-sniffing the repo. Flutter wins the tie
   because a Flutter app also carries `android/settings.gradle`.
-- Both Android release compilers run through `android_build_diagnostics.py` inside the
-  existing proxy wrapper. It retains at most 64 KiB of private child output and publishes
+- Both Android release compilers run through `android_build_diagnostics.py`.
+  It retains at most 64 KiB of private child output and publishes
   only fixed signal names, phase and exit status in `android_build_failed`. An empty signal
   list is unclassified, never a guessed cause; matching signals are observations, not a retry
   decision. Minute progress notices replace raw compiler output. Preserve the actual exit,
-  command arguments, proxy environment, signing and symbol checks.
+  command arguments, signing and symbol checks.
 - iOS plist stamping reads complete JSON build settings through `resolve_info_plist.py`,
   preserving Xcode's exit status and bounded sanitized stderr. Select exactly the configured
   bundle's application target and resolve paths from that target's source root; never take
@@ -281,15 +261,15 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   updates, retain inherited proxies, and never enable provisioning network operations.
 - Native Xcode validation and archives first check the selected project/workspace graph with
   `native_dependency_guard.py ROOT --container PATH`. Xcode-managed Swift packages remain refused:
-  proxy environment variables do not protect SwiftPM downloads. The same app session preserves
+  they resolve outside the committed lockfile the guard exists to enforce. The same app session preserves
   source and uses the vendor's official CocoaPods distribution or verified local XCFrameworks.
-  `native_pods.py` installs a committed, unchanged `Podfile.lock` with `pod install --deployment`
-  through the existing Google relay, then checks the completed workspace. No Podfile means no
-  dependency download or Google proxy requirement. Initial local lock resolution may use the
+  `native_pods.py` installs a committed, unchanged `Podfile.lock` with `pod install --deployment`,
+  then checks the completed workspace. No Podfile means no dependency download at all.
+  Initial local lock resolution may use the
   explicit `--before-pods --initial-pods-lock` guard; CI never uses that development exception.
   These checks cover the declared native dependency graph, not arbitrary custom build-script traffic.
   `native_bundle.py` honors the selected project's committed Gemfile/lock, falling back to
-  the repository root; missing gems install through the same relay with a frozen bundle.
+  the repository root; missing gems install with a frozen bundle.
   Both Flutter configuration and the Pods helper use that bundle in their child process,
   preserving Podfile.lock and the parent job environment. Deliver the workflow wrapper and
   action helper together; action-only updates cannot repair earlier custom configuration steps.
@@ -339,10 +319,8 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   must not discard the symbols of a build that is already live. Symbol
   artifacts carry no `retention-days` so the repository's setting governs and
   can be raised to cover a release's life.
-- Firebase Crashlytics traffic follows the Google account proxy. Android builds and
-  the pinned Firebase CLI receive the explicit proxy environment; Crashlytics Gradle
-  2.9.2+ and the pinned buildtools support it; generic JVM networking uses the relay.
-  Native iOS upload-symbols uses NSURLSession, so it is never executed. Before
+- Firebase Crashlytics traffic leaves the runner directly, like every other provider
+  request in CI. Native iOS upload-symbols uses NSURLSession, so it is never executed. Before
   archiving, dedicated Crashlytics upload phases in the ephemeral Xcode projects
   are deferred; mixed/unidentified upload phases refuse the archive for repair.
   CI retains the archive's dSYMs as a ZIP with UUIDs, source SHA and SHA-256, then
@@ -351,18 +329,18 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   account-pinned Firebase console, reading processing back before completing the
   delivery request. This requires no human handoff. A green CI run alone is not
   evidence that the deferred symbols reached Firebase. Android retains its Dart
-  symbols and uploads them before the store bundle, using the configured proxy.
+  symbols and uploads them before the store bundle.
 - Crashlytics buildtools bootstrap runs before Flutter compilation. `crashlytics_bootstrap.py`
   pins the official JAR version, byte size and SHA-256, admits only verified dependency-cache
-  bytes, and bounds proxied GET recovery to three attempts within three minutes. Java receives
+  bytes, and bounds GET recovery to three attempts within three minutes. Java receives
   that verified file through `CRASHLYTICS_LOCAL_JAR`; changing the Firebase CLI pin must check
   its JAR version/override contract. TLS, authorization and checksum errors never retry.
   `firebase_symbols_bootstrap_failed` carries fixed typed evidence, never private curl output.
 - Play readiness and AAB/APK version inventory share one prebuild edit. Retry OAuth
   transport, inventory reads and cleanup of that known edit; never replay an ambiguous
   `edits.insert`. Edit creation retries at most three times only for typed connection-timeout
-  or typed connection failure / CONNECT 502,503,504 evidence that no provider request was sent. Bare proxy errors,
-  TLS verification failures, provider responses and lost origin responses do not authorize a retry.
+  or typed connection failure evidence that no provider request was sent. TLS verification
+  failures, provider responses and lost origin responses do not authorize a retry.
   Only an explicit package-404 allows first-release defaults; failed
   inventory is not an empty account. The action exposes `play-api-ready` so current
   workflows skip the redundant postbuild check. Error annotations carry safe
@@ -392,7 +370,7 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   bytes before running Node24. It classifies immediate private child output, never live
   GitHub annotations: expired/deleted retries normally; only the exact cannot-auto-submit
   refusal permits a review hold. Unknown/transport/post-commit uncertainty does not replay.
-  The existing signed AAB, proxy, track/status/rollout and notes survive one bounded retry;
+  The existing signed AAB, track/status/rollout and notes survive one bounded retry;
   only a successful hold emits `play_review_pending`. Keep raw child output out of receipts.
   Each attempt also emits brace-free `play_upload_diagnostic` with fixed observed progress,
   process outcome and error signals from bounded private stdout/stderr line buffers.
@@ -424,8 +402,8 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   only exact terminal run/attempt/source proof permits CI-owner recovery.
   Both entrypoints emit brace-free `play_edit_owner` errors with fixed codes and optional child
   exit evidence, preserving the existing upload receipt and refusal. Never reconstruct masked text.
-  Other packages stay parallel. The GitHub coordination request is fixed-origin and does not
-  change the Google account proxy. Update workflow wiring as well as action directories.
+  Other packages stay parallel. The GitHub coordination request is fixed-origin.
+  Update workflow wiring as well as action directories.
 
 - Mobile Deploy watches `.factory/releases/mobile.json`, produced from committed task source and
   the named build-variable allow-list shared by freeze and runtime in `mobile_inputs.cjs`.
@@ -435,6 +413,11 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   recorded immediately in repository deployment receipts; retries reuse their prior-run evidence.
   An uncertain upload never starts another binary automatically. Preserve its signed artifact,
   complete exact provider readback/recovery through scoped tooling, then reconcile its receipt.
+  `action/scripts/recover_upload_intent.cjs owner/repo deployment-id plan|live` repairs only
+  an iOS intent whose exact terminal run has one failed HTTP 500 intent step and an explicitly
+  skipped uploader in the complete GitHub job log. It refuses later run attempts and changed
+  evidence, appends a read-back building receipt, and never uploads or calls Apple. Retry the
+  original failed job afterward; preserve the recovery proof separately.
   The local Android workflow supplies `mobileReleaseIntentScript` to the upload wrapper instead
   of marking `uploading` before acquiring Play ownership. A refused owner leaves the release
   record at `building`; the wrapper records intent inside its acquired lease before provider

package/README.md

@@ -78,7 +78,7 @@ action-only updates do not change triggers. Preserve custom build inputs and rea
 
 Flutter's optional SDK and pub cache restores have a one-minute timeout per
 download segment. A slow segment becomes a cache miss and normal SDK setup
-continues through the assigned Google proxy; SDK setup errors still fail the
+continues normally; SDK setup errors still fail the
 job. This bounds individual cache segments, not the total cache or SDK download,
 and keeps existing cache keys. A successfully installed SDK is saved before app
 checks run, so a later test/build failure does not force another cold SDK download.
@@ -401,12 +401,13 @@ successful preparation reports `pod_attempts`. Dependency locks, relay and TLS c
 SDK transfers also emit `flutter_download_progress` notices with schema
 `gowalk-cicd/flutter-download-progress.v1`. Each carries `phase`, `event`, `elapsed_ms`
 and `retained_bytes`; `attempt_finished` adds `attempt`, `curl_exit`, `http_status`
-and `proxy_status`. In-progress notices arrive each minute; elapsed time belongs to
+and `proxy_status` (retained for schema compatibility; always 0 now that CI reaches
+providers directly). In-progress notices arrive each minute; elapsed time belongs to
 the current attempt. Archives have a 20-minute total transfer budget so a failure
 receipt precedes a 30-minute validation job's deadline. Progress is not a success receipt.
 When SDK caching is enabled, an exhausted transfer preserves its partial public archive for
 the next run under a separate release-specific cache key. Resumption still uses the selected
-official manifest digest and the configured provider proxy; only a verified complete archive
+official manifest digest; only a verified complete archive
 can reach SDK extraction. Partial-cache restore uses the existing one-minute cache segment
 bound. Optional cache operations do not extend the transfer deadline or turn a failed installation green.
 
@@ -442,8 +443,8 @@ standalone preflight. Refreshing the workflow alongside actions removes that lat
 
 The API readiness preflight retries transient OAuth transport failures and cleanup of
 its own known edit up to three times, with one- and two-second delays. It never
-replays an edit creation whose outcome is unknown. Every request keeps the assigned
-Google proxy; an absent edit after cleanup is already closed. Exhausted recovery
+replays an edit creation whose outcome is unknown. An absent edit after cleanup is
+already closed. Exhausted recovery
 emits the `play_preflight_failed` error annotation with schema
 `gowalk-cicd/play-preflight-failure.v1`, phase (`oauth_refresh`, `edit_create`,
 `version_inventory` or `edit_cleanup`), classified code and attempt count. Provider bodies, credential
@@ -453,8 +454,8 @@ edit ID and `cleanup_required: true` so recovery targets that edit.
 The upload wrapper at `android-action/play-upload/` runs the unchanged official
 `r0adkll/upload-google-play` revision `e738b9dd8f2476ea806d921b64aacd24f34515a5` in
 Node24. Its fixed GitHub download is checked against the recorded size and SHA256
-before execution; an absent or changed program refuses upload. Both proxy spellings
-and bypass variables are explicitly set for only that provider subprocess.
+before execution; an absent or changed program refuses upload. The subprocess inherits
+the job's own environment and reaches Google directly.
 
 The wrapper permits at most two attempts within one hour, reusing the existing
 signed bundle, track, status, rollout fraction and release notes:
@@ -520,15 +521,8 @@ and after. Linux only; skipped in Bitrise mode. npm survives on purpose: the
 the Firebase CLI through `npx`.
 
 The preinstalled Android SDK and NDKs are retained. Gradle and SDK-manager Java
-networking runs through an owned loopback relay to `GOOGLE_STORE_PROXY_URL`.
-The relay authenticates to that exit without putting credentials in JVM options;
-HTTPS remains an end-to-end TLS tunnel. An unavailable proxy fails the request,
-and the relay shuts down with its child command. Gradle daemons are disabled for
-these commands so they cannot retain an expired relay port.
-Java requests to exact `localhost`, `127.0.0.1` and `[::1]` targets stay local for
-HTTP test fixtures. All other Java hosts, including lookalike names such as
-`localhost.example.com`, retain the assigned proxy; environment-first clients
-continue to use the relay.
+networking reaches Google directly, like every other provider request in CI.
+Gradle daemons stay disabled for these commands.
 
 ### Private git dependencies (Flutter)
 
@@ -775,16 +769,13 @@ directory to that service from your own pipeline.
 
 Set the repository variable to the Firebase App IDs for the shipping platforms
 (`1:<project>:ios:<hash>` and/or `1:<project>:android:<hash>`). The workflow passes it
-as the `firebase-app-id` input. Configure the account's `GOOGLE_STORE_PROXY_URL`
-repository secret before any provider operation.
+as the `firebase-app-id` input.
 
-Android builds and the pinned Firebase CLI receive the proxy explicitly, including
-Crashlytics mapping/native-symbol uploads. Crashlytics Gradle 2.9.2+ supports proxy
-environment variables; older versions must be updated before use. Dart symbols are
-retained as artifacts and uploaded through that transport before the bundle ships.
+Android builds and the pinned Firebase CLI upload Crashlytics mapping and native symbols
+directly. Dart symbols are retained as artifacts and uploaded before the bundle ships.
 
-Before Flutter compilation, the action downloads Crashlytics buildtools 3.0.3 through
-the assigned account proxy and verifies its exact size and SHA-256. Verified bytes are
+Before Flutter compilation, the action downloads Crashlytics buildtools 3.0.3 and
+verifies its exact size and SHA-256. Verified bytes are
 reused from the runner dependency cache and supplied through the Firebase CLI's
 `CRASHLYTICS_LOCAL_JAR` override. GET recovery allows three attempts within three minutes;
 TLS, authorization and checksum refusals stop immediately. A bootstrap failure emits
@@ -806,26 +797,22 @@ is required. A completed CI run does not mean this deferred upload is complete.
 
 The iOS composite action runs on `macos-15` and:
 
-All Apple and Google store requests require an account-pinned proxy, including OAuth,
-metadata and binary transfer. Provision `APPLE_STORE_PROXY_URL` and
-`GOOGLE_STORE_PROXY_URL` as encrypted repository secrets before deployment. A missing
-proxy refuses provider calls; there is no direct fallback. Refresh existing workflow
-files with the released installer while preserving application-specific build inputs.
-The Google pin also covers Flutter SDK manifest/archive downloads and early `pub`
-operations in iOS, Android and web workflows. Bootstrap validates it before SDK setup;
-subsequent Dart and JVM operations use the same owned relay as release builds. A fork
-without the repository secret cannot start provider downloads through these workflows.
+GitHub Actions reaches Apple and Google **directly**. No store proxy is configured, read
+or inherited here: the account-pinned residential exit belongs to the panel and the runner
+Macs, which are the hosts that must not appear to the stores as generic infrastructure.
+`APPLE_STORE_PROXY_URL` and `GOOGLE_STORE_PROXY_URL` are no longer used by any workflow,
+action or helper, and must not be reintroduced. Refresh existing workflow files with the
+released installer while preserving application-specific build inputs.
 The Apple uploader retains `apple-upload-<run>-<attempt>` receipts with IPA SHA-256,
 upload ID and processing readback, and resumes matching bytes after interruption.
 
 GitHub artifact traffic uses a separate, per-action transport scope. The exact pinned
 `actions/upload-artifact` client can reach approved GitHub Results and artifact-storage
-HTTPS origins without inheriting the store proxy; unknown programs and destinations are
-refused. The scope ends with that Node process. Apple/Google calls retain their assigned
-exit, and a failed artifact creation, transfer or finalization still fails delivery.
+HTTPS origins; unknown programs and destinations are refused. The scope ends with that
+Node process, and a failed artifact creation, transfer or finalization still fails delivery.
 Adoption requires updating workflow upload steps as well as the distributed actions while
-preserving each app's custom checks and artifact retention settings. This fixes the proven
-inherited-proxy path; an isolated `ECONNRESET` does not identify every possible network fault.
+preserving each app's custom checks and artifact retention settings. An isolated
+`ECONNRESET` does not identify every possible network fault.
 
 1. **Auto-detects** your `.xcodeproj` / `.xcworkspace`, scheme, bundle ID,
    and `team_id` (from the ASC API key). No `ci.config.yaml` required —
@@ -843,7 +830,7 @@ inherited-proxy path; an isolated `ECONNRESET` does not identify every possible
    `CI-<bundle_id>`. Patches the `.pbxproj` to use Manual signing against those
    profiles.
 6. **Archives** with `xcodebuild archive`, exports the IPA, and uploads via
-   Apple's build-upload REST API through `APPLE_STORE_PROXY_URL`.
+   Apple's build-upload REST API.
 7. **Sets "What's New"** on every declared localization (reads
    `fastlane/metadata/ios/<locale>/release_notes.txt` if present, or from the
    `app-store-whats-new` input).
@@ -1205,7 +1192,7 @@ A completed file is reused only when its content-derived filename and size match
 any returned file checksum is verified.
 
 A failed upload emits the typed `apple_build_upload_failed` error annotation with schema
-`gowalk-cicd/apple-build-upload-failed.v2`: `category` (`proxy_missing`, `ipa_invalid`,
+`gowalk-cicd/apple-build-upload-failed.v2`: `category` (`ipa_invalid`,
 `configuration_missing`, `app_mismatch`, `provider_request_failed`, `upload_identity_conflict`,
 `upload_destination_invalid`, `ipa_changed`, `part_refused`, `processing_failed`,
 `processing_pending`, or a fallback such as `local_io`), `stage`, `receipt_available` and
@@ -1216,9 +1203,8 @@ published. The job also retains the exact exported IPA as `apple-ipa-<run>-<atte
 different bytes under the same number. Build numbers come from `/builds`,
 `/preReleaseVersions` **and** `/apps/{id}/buildUploads`, so an unfinished or refused
 reservation is never reused; delete such a reservation only after reading it back.
-All requests and parts still use the Apple proxy.
 
-Flutter SDK setup retries interrupted manifest and archive GETs on the assigned proxy, with four attempts
+Flutter SDK setup retries interrupted manifest and archive GETs, with four attempts
 within 60 seconds for manifests or 30 minutes for archives, with an 8 GiB archive bound. Retries resume private bytes
 with HTTP Range; if the origin ignores Range, a bounded full restart is permitted. The completed archive
 must match the selected official manifest's SHA-256 before extraction. Authentication and certificate

package/action/.daemux-version

@@ -1 +1 @@
-1.0.145
+1.0.147

package/action/action.yml

@@ -204,14 +204,6 @@ runs:
         rm -rf "$RUNNER_TEMP/swift-app-action"
         mkdir -p "$RUNNER_TEMP/swift-app-action"
         cp -R "${{ github.action_path }}/." "$RUNNER_TEMP/swift-app-action/"
-        # Native repositories receive the same canonical Google transport as Android.
-        mkdir -p "$RUNNER_TEMP/swift-app-action/google-transport"
-        for helper in play_store_proxy.py jvm_proxy_relay.py; do
-          if [ -f "$GITHUB_WORKSPACE/.github/actions/android-app/scripts/$helper" ]; then
-            cp "$GITHUB_WORKSPACE/.github/actions/android-app/scripts/$helper" \
-              "$RUNNER_TEMP/swift-app-action/google-transport/$helper"
-          fi
-        done
         echo "SWIFT_APP_ACTION=$RUNNER_TEMP/swift-app-action" >> "$GITHUB_ENV"
 
     # The plugin self-update runs BEFORE the version, signing and archive
@@ -359,7 +351,6 @@ runs:
         fi
         if ! python3 "$SWIFT_APP_ACTION/scripts/native_pods.py" "$GITHUB_WORKSPACE" \
           --container "${INPUT_WORKSPACE:-$INPUT_PROJECT}" \
-          --proxy-helper "$SWIFT_APP_ACTION/google-transport/play_store_proxy.py" \
           > "$RUNNER_TEMP/native-pods.json"; then
           cat "$RUNNER_TEMP/native-pods.json"
           exit 1

package/action/scripts/asc_common.py

@@ -16,8 +16,6 @@ from typing import Any
 import jwt
 import requests
 
-from apple_store_proxy import proxies
-
 
 ASC_BASE = "https://api.appstoreconnect.apple.com/v1"
 
@@ -156,9 +154,8 @@ def _request_timeouts() -> tuple[float, float]:
 
 
 def _network_error_category(exc: BaseException) -> str:
-    """Closed diagnostic labels only; exception text can contain private proxy URLs."""
+    """Closed diagnostic labels only; exception text can contain private URLs."""
     for error_type, category in (
-        (requests.exceptions.ProxyError, "proxy"),
         (requests.exceptions.SSLError, "tls"),
         (requests.exceptions.ConnectTimeout, "connect_timeout"),
         (requests.exceptions.ReadTimeout, "read_timeout"),
@@ -180,11 +177,11 @@ def _retry_network_error(
     if attempt >= total - 1:
         raise SystemExit(
             f"ASC {method} {path} network error after {total} "
-            f"attempts through the configured proxy (category={category})"
+            f"attempts (category={category})"
         )
     delay = backoffs[attempt]
     print(
-        f"ASC {method} {path} network error through the configured proxy; "
+        f"ASC {method} {path} network error; "
         f"retrying in {delay}s ({attempt + 1}/{total - 1}; category={category})",
         file=sys.stderr,
     )
@@ -240,7 +237,7 @@ def request(
         try:
             resp = requests.request(
                 method, url, headers=headers, params=params,
-                json=json_body, timeout=timeout, proxies=proxies(),
+                json=json_body, timeout=timeout,
             )
         except requests.RequestException as exc:
             _retry_network_error(method, path, attempt, total, backoffs, exc)

package/action/scripts/mobile_release_api.cjs

@@ -1,6 +1,8 @@
 /* Repository-local GitHub deployment receipts; never a store credential or transport. */
 'use strict';
 const https = require('node:https');
+const {randomUUID} = require('node:crypto');
+const {setTimeout: delay} = require('node:timers/promises');
 
 function request(method, path, body, timeoutMs = 30000) {
   const repo = process.env.GITHUB_REPOSITORY;
@@ -29,10 +31,43 @@ function request(method, path, body, timeoutMs = 30000) {
   });
 }
 
+function uncertain(error) {
+  return /^mobile_release_(http_5\d\d|receipt_(read_unavailable|invalid|transport_unconfirmed|unconfirmed))$/
+    .test(error.message);
+}
+
+function confirmed(result, expected) {
+  return Number.isSafeInteger(result?.id) && result.id > 0 && result.state === expected.state &&
+    result.description === expected.description && result.log_url === expected.log_url;
+}
+
+async function readStatus(id, expected) {
+  for (let attempt = 0; attempt < 3; attempt++) {
+    if (attempt) await delay(attempt * 1000);
+    try {
+      const rows = await request('GET', `/deployments/${id}/statuses?per_page=1`, undefined, 10000);
+      if (Array.isArray(rows) && confirmed(rows[0], expected)) return rows[0];
+    } catch (error) {
+      if (!uncertain(error)) break;
+    }
+  }
+  return null;
+}
+
 async function status(id, phase, state = 'in_progress') {
-  const result = await request('POST', `/deployments/${id}/statuses`, {state, description: phase, auto_inactive: false,
-    log_url: `https://github.com/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`});
-  if (result.state !== state || result.description !== phase) throw Error('mobile_release_receipt_unconfirmed');
-  return result;
+  const run = `https://github.com/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
+  const expected = {state, description: phase, auto_inactive: false,
+    log_url: `${run}/attempts/${process.env.GITHUB_RUN_ATTEMPT}#mobile-receipt-${randomUUID()}`};
+  try {
+    const result = await request('POST', `/deployments/${id}/statuses`, expected);
+    if (!confirmed(result, expected)) throw Error('mobile_release_receipt_unconfirmed');
+    return result;
+  } catch (error) {
+    if (!uncertain(error)) throw error;
+    // Reconcile this invocation's one write. Never replay the POST or infer an upload from another receipt.
+    const result = await readStatus(id, expected);
+    if (result) return result;
+    throw error;
+  }
 }
 module.exports = {request, status};

package/action/scripts/native_bundle.py

@@ -66,7 +66,7 @@ def unchanged(snapshot: dict[Path, str]) -> None:
             raise guard.Refused("native_bundle_inputs_changed")
 
 
-def prepare(root: Path, folder: Path, proxy_helper: Path, log) -> tuple[list[str], dict[Path, str]]:
+def prepare(root: Path, folder: Path, log) -> tuple[list[str], dict[Path, str]]:
     gemfile = next((p for p in (folder / "Gemfile", root / "Gemfile") if p.exists() or p.is_symlink()), None)
     if gemfile is None:
         return [], {}
@@ -74,7 +74,7 @@ def prepare(root: Path, folder: Path, proxy_helper: Path, log) -> tuple[list[str
                 gemfile.with_name("Gemfile.lock"): committed(root, gemfile.with_name("Gemfile.lock"), "gemfile_lock")}
     prefix = ["/usr/bin/env", "BUNDLE_GEMFILE=" + str(gemfile), "BUNDLE_FROZEN=true",
               "BUNDLE_PATH=" + (os.environ.get("BUNDLE_PATH") or str(root / ".factory/toolchain/gems"))]
-    relay = [sys.executable, str(proxy_helper), "--", *prefix, "bundle"]
+    relay = [*prefix, "bundle"]
     if command([*relay, "check"], gemfile.parent, log):
         if command([*relay, "install", "--jobs", "2", "--retry", "1"], gemfile.parent, log):
             refuse("native_bundle_install_failed", log, guard.Refused)
@@ -82,10 +82,9 @@ def prepare(root: Path, folder: Path, proxy_helper: Path, log) -> tuple[list[str
     return [*prefix, "bundle", "exec"], snapshot
 
 
-def run(root: Path, folder: Path, proxy_helper: Path, argv: list[str]) -> dict:
+def run(root: Path, folder: Path, argv: list[str]) -> dict:
     root = root.resolve(strict=True)
     folder = (root / folder).resolve(strict=True)
-    proxy_helper = proxy_helper.resolve(strict=True)
     if not folder.is_relative_to(root) or not argv:
         raise guard.Refused("native_bundle_path_unverified")
     if (folder / "Podfile").is_symlink():
@@ -93,10 +92,8 @@ def run(root: Path, folder: Path, proxy_helper: Path, argv: list[str]) -> dict:
     pod_lock = folder / "Podfile.lock"
     pod_snapshot = {pod_lock: committed(root, pod_lock, "podfile_lock")} if (folder / "Podfile").exists() else {}
     with tempfile.TemporaryFile() as log:
-        if command([sys.executable, str(proxy_helper)], root, log):
-            raise guard.Refused("native_google_proxy_required")
-        prefix, snapshot = prepare(root, folder, proxy_helper, log)
-        if command([sys.executable, str(proxy_helper), "--", *prefix, *argv], root, log):
+        prefix, snapshot = prepare(root, folder, log)
+        if command([*prefix, *argv], root, log):
             refuse("native_configuration_failed", log, guard.Refused)
         unchanged(snapshot)
         for path, digest in pod_snapshot.items():
@@ -114,12 +111,11 @@ def main(argv: list[str]) -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--root", type=Path, default=Path.cwd())
     parser.add_argument("--folder", type=Path, default=Path("ios"))
-    parser.add_argument("--proxy-helper", type=Path, required=True)
     parser.add_argument("command", nargs=argparse.REMAINDER)
     args = parser.parse_args(argv)
     command_args = args.command[1:] if args.command[:1] == ["--"] else args.command
     try:
-        answer = run(args.root, args.folder, args.proxy_helper, command_args)
+        answer = run(args.root, args.folder, command_args)
     except (guard.Refused, OSError, subprocess.SubprocessError) as exc:
         code = str(exc) if isinstance(exc, guard.Refused) else "native_bundle_operation_unverified"
         answer = {"ok": False, "code": code, "next": remediation(code)}

package/action/scripts/native_dependency_guard.py

@@ -9,8 +9,8 @@ import sys
 
 from native_project_graph import Refused, project, selected, workspace
 
-REMEDIATION = ("Preserve source; use the vendor's official CocoaPods distribution through the assigned Google proxy "
-               "and commit Podfile.lock, or verified local XCFrameworks; rerun the same task's build.")
+REMEDIATION = ("Preserve source; use the vendor's official CocoaPods distribution and commit "
+               "Podfile.lock, or verified local XCFrameworks; rerun the same task's build.")
 
 
 def check(root: Path, container: str = "", *, before_pods: bool = False, initial_pods_lock: bool = False) -> dict:

package/action/scripts/native_pods.py

@@ -30,7 +30,7 @@ def committed(root: Path, lock: Path) -> str:
     return hashlib.sha256(result.stdout).hexdigest()
 
 
-def prepare(root: Path, container: str, proxy_helper: Path) -> dict:
+def prepare(root: Path, container: str) -> dict:
     root = root.resolve(strict=True)
     folder = (root / container).parent.resolve(strict=True) if container else root
     if not folder.is_relative_to(root):
@@ -40,22 +40,17 @@ def prepare(root: Path, container: str, proxy_helper: Path) -> dict:
     if (folder / "Podfile").is_symlink():
         raise guard.Refused("native_workspace_reference_unverified")
     digest = committed(root, folder / "Podfile.lock")
-    if not proxy_helper.is_file():
-        raise guard.Refused("native_google_transport_helper_required")
-    proxy_helper = proxy_helper.resolve(strict=True)
     with tempfile.TemporaryFile() as log:
-        if command([sys.executable, str(proxy_helper)], root, log):
-            raise guard.Refused("native_google_proxy_required")
         if not list(folder.glob("*.xcodeproj")) and (folder / "project.yml").is_file():
             if command(["xcodegen", "generate"], folder, log):
                 refuse("native_project_generation_failed", log, guard.Refused)
         initial = container or str(guard.selected(root, "", True).relative_to(root))
         guard.check(root, initial, before_pods=True)
-        prefix, bundle_snapshot = native_bundle.prepare(root, folder, proxy_helper, log)
+        prefix, bundle_snapshot = native_bundle.prepare(root, folder, log)
         snapshot = {**bundle_snapshot, folder / "Podfile.lock": digest,
                     folder / "Podfile": hashlib.sha256((folder / "Podfile").read_bytes()).hexdigest()}
         code, attempts = native_pods_retry.install(
-            [sys.executable, str(proxy_helper), "--", *prefix, "pod", "install", "--deployment", "--no-repo-update"],
+            [*prefix, "pod", "install", "--deployment", "--no-repo-update"],
             folder, log, snapshot)
         if code:
             refuse("native_pods_install_failed", log, guard.Refused)
@@ -81,10 +76,9 @@ def main(argv: list[str]) -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("root", type=Path)
     parser.add_argument("--container", default="")
-    parser.add_argument("--proxy-helper", type=Path, required=True)
     args = parser.parse_args(argv)
     try:
-        answer = prepare(args.root, args.container, args.proxy_helper)
+        answer = prepare(args.root, args.container)
     except (guard.Refused, OSError, subprocess.SubprocessError) as exc:
         code = str(exc) if isinstance(exc, guard.Refused) else "native_pods_operation_unverified"
         answer = {"ok": False, "code": code, "next": guard.REMEDIATION}