gowalk-cicd 1.0.152 → 1.0.154

package/CLAUDE.md

@@ -265,6 +265,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   list is unclassified, never a guessed cause; matching signals are observations, not a retry
   decision. Minute progress notices replace raw compiler output. Preserve the actual exit,
   command arguments, signing and symbol checks.
+- Offline delivery preflight recognizes compiled single-size icons through `delivery_icons.py`.
+  Require matching 1024 `Icon Image` and `MultiSized Image` index records per declared device idiom;
+  do not treat an arbitrary 1024 image as coverage or weaken missing-family checks.
 - iOS plist stamping reads complete JSON build settings through `resolve_info_plist.py`,
   preserving Xcode's exit status and bounded sanitized stderr. Select exactly the configured
   bundle's application target and resolve paths from that target's source root; never take

package/action/.daemux-version

@@ -1 +1 @@
-1.0.152
+1.0.154

package/action/scripts/delivery_icons.py

@@ -0,0 +1,33 @@
+"""Recognize Xcode's compiled single-size iOS app-icon representation."""
+import re
+
+
+def single_size_idioms(renditions: list[dict]) -> set[str]:
+    """Require a 1024 icon image AND its matching multi-size index for each idiom.
+
+    Xcode 26.3 expands a universal iOS source slot into phone/pad records. It
+    does not retain the source's universal idiom or emit every smaller square.
+    A bare large image is insufficient evidence of this compiled icon format.
+    """
+    images = {
+        (row.get("Name"), row.get("Idiom"), row.get("Icon Index"))
+        for row in renditions
+        if row.get("AssetType") == "Icon Image"
+        and row.get("PixelWidth") == 1024 and row.get("PixelHeight") == 1024
+        and row.get("Scale") == 1 and row.get("Idiom") in {"phone", "pad"}
+        and type(row.get("Icon Index")) is int
+    }
+    covered = set()
+    for row in renditions:
+        if row.get("AssetType") != "MultiSized Image" or row.get("Scale") != 1:
+            continue
+        sizes = row.get("Sizes")
+        if not isinstance(sizes, list):
+            continue
+        for size in sizes:
+            match = re.fullmatch(r"1024x1024 index:(\d+) idiom:(phone|pad)", str(size))
+            if not match or row.get("Idiom") != match[2]:
+                continue
+            if (row.get("Name"), match[2], int(match[1])) in images:
+                covered.add(match[2])
+    return covered

package/action/scripts/delivery_preflight.py

@@ -33,6 +33,8 @@ import subprocess
 import sys
 import zipfile
 
+from delivery_icons import single_size_idioms
+
 SCHEMA = "gowalk-cicd/apple-delivery-preflight.v1"
 
 #: Apple's `assetutil` lives outside the selected Xcode and needs no developer dir.
@@ -51,8 +53,9 @@ REQUIRED_ICONS = {
 #: as a missing icon — that would refuse every correct build.
 FLATTENED_ICON_SIZES = frozenset({120, 152})
 
-#: Xcode 14+ lets one `universal` 1024 entry stand for every device family, and
-#: `actool` then emits a single universal rendition instead of per-idiom ones.
+#: Xcode 14+ lets one `universal` 1024 entry stand for every device family.
+#: Older compiled catalogs can retain a universal rendition. Newer Xcode also
+#: emits indexed phone/pad single-size records, recognized by delivery_icons.
 #: Demanding `pad` renditions of such a catalog would refuse a correct app, so a
 #: universal app-icon rendition satisfies every family.
 UNIVERSAL_IDIOMS = frozenset({"universal"})
@@ -261,10 +264,13 @@ def check_app_icons(ctx: dict) -> list[dict]:
         # One universal icon covers every family; per-idiom renditions do not exist
         # for it and demanding them would refuse a correct Xcode 14+ catalog.
         return []
+    single_size = single_size_idioms(_icon_renditions(renditions or []))
     for family in sorted(families):
         if family not in REQUIRED_ICONS:
             continue
         idiom, required = REQUIRED_ICONS[family]
+        if idiom in single_size:
+            continue
         device = "iPad" if family == 2 else "iPhone"
         for pixels, label in required:
             if renditions is not None:
@@ -307,7 +313,7 @@ def check_marketing_icon(ctx: dict) -> list[dict]:
     present = any(item.get("PixelWidth") == 1024 and item.get("PixelHeight") == 1024
                   and str(item.get("Idiom") or "") in UNIVERSAL_IDIOMS | {"marketing"}
                   for item in icons)
-    if present:
+    if present or single_size_idioms(icons):
         return []
     return [{"itms": "ITMS-90704",
              "message": "no 1024x1024 App Store marketing icon in the compiled asset catalog",

package/action/scripts/fixtures/single-size-ios-icon.json

@@ -0,0 +1,38 @@
+[
+  {
+    "AssetType": "Icon Image",
+    "Icon Index": 1,
+    "Idiom": "phone",
+    "Name": "AppIcon",
+    "PixelHeight": 1024,
+    "PixelWidth": 1024,
+    "Scale": 1
+  },
+  {
+    "AssetType": "Icon Image",
+    "Icon Index": 1,
+    "Idiom": "pad",
+    "Name": "AppIcon",
+    "PixelHeight": 1024,
+    "PixelWidth": 1024,
+    "Scale": 1
+  },
+  {
+    "AssetType": "MultiSized Image",
+    "Idiom": "phone",
+    "Name": "AppIcon",
+    "Scale": 1,
+    "Sizes": [
+      "1024x1024 index:1 idiom:phone"
+    ]
+  },
+  {
+    "AssetType": "MultiSized Image",
+    "Idiom": "pad",
+    "Name": "AppIcon",
+    "Scale": 1,
+    "Sizes": [
+      "1024x1024 index:1 idiom:pad"
+    ]
+  }
+]

package/action/scripts/test_delivery_icons.py

@@ -0,0 +1,76 @@
+"""Regression for Xcode 26.3 compiling one universal iOS 1024 source icon.
+
+The fixture retains only structural assetutil fields from a real signed archive;
+it contains neither artwork nor signing data. Catalog mutations must fail closed.
+"""
+import json
+from pathlib import Path
+import sys
+import unittest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import delivery_preflight as preflight
+
+
+def context():
+    rows = json.loads((Path(__file__).parent / "fixtures/single-size-ios-icon.json").read_text())
+    return {"families": {1, 2}, "renditions": rows, "flattened": {120, 152}}
+
+
+class SingleSizeIconTests(unittest.TestCase):
+    def test_real_compiled_single_size_catalog_covers_phone_pad_and_marketing(self):
+        ctx = context()
+        self.assertEqual(preflight.check_app_icons(ctx), [])
+        self.assertEqual(preflight.check_marketing_icon(ctx), [])
+
+    def test_one_idiom_does_not_cover_the_other_declared_family(self):
+        ctx = context()
+        ctx["renditions"] = [r for r in ctx["renditions"] if r["Idiom"] == "phone"]
+        failures = preflight.check_app_icons(ctx)
+        self.assertEqual(len(failures), 2)
+        self.assertTrue(all("iPad" in item["message"] for item in failures))
+        ctx["families"] = {1}
+        self.assertEqual(preflight.check_app_icons(ctx), [])
+
+    def test_large_image_without_multi_size_index_does_not_prove_coverage(self):
+        ctx = context()
+        ctx["renditions"] = [r for r in ctx["renditions"] if r["AssetType"] == "Icon Image"]
+        self.assertEqual(len(preflight.check_app_icons(ctx)), 4)
+        self.assertEqual(len(preflight.check_marketing_icon(ctx)), 1)
+
+    def test_index_without_icon_image_does_not_prove_coverage(self):
+        ctx = context()
+        ctx["renditions"] = [r for r in ctx["renditions"] if r["AssetType"] == "MultiSized Image"]
+        self.assertEqual(len(preflight.check_app_icons(ctx)), 4)
+        self.assertEqual(len(preflight.check_marketing_icon(ctx)), 1)
+
+    def test_mismatched_catalog_pairs_do_not_cover_the_changed_idiom(self):
+        changes = [{"Icon Index": 2}, {"Name": "AppIconOther"}, {"PixelHeight": 512},
+                   {"PixelWidth": 512}, {"Scale": 2}, {"AssetType": "Image"},
+                   {"Idiom": "unrelated"}]
+        for change in changes:
+            with self.subTest(change=change):
+                ctx = context()
+                ctx["renditions"][0].update(change)
+                failures = preflight.check_app_icons(ctx)
+                self.assertEqual(len(failures), 2)
+                self.assertTrue(all("iPhone" in item["message"] for item in failures))
+
+    def test_unrelated_asset_name_cannot_supply_an_app_icon(self):
+        ctx = context()
+        for row in ctx["renditions"]:
+            row["Name"] = "HeroImage"
+        self.assertEqual(len(preflight.check_app_icons(ctx)), 4)
+
+    def test_malformed_or_wrong_index_metadata_is_not_coverage(self):
+        invalid = [None, "1024x1024 index:1 idiom:phone", ["1024x1024 index:2 idiom:phone"],
+                   ["1024x1024 index:1 idiom:pad"], ["512x512 index:1 idiom:phone"]]
+        for sizes in invalid:
+            with self.subTest(sizes=sizes):
+                ctx = context()
+                ctx["renditions"][2]["Sizes"] = sizes
+                self.assertEqual(len(preflight.check_app_icons(ctx)), 2)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.152
+1.0.154

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.152
+1.0.154

package/backend-action/network_pools.py

@@ -204,7 +204,9 @@ def validate_rules(rows):
         expected += [dict(marked, priority=5210, table='main'), dict(marked, priority=5230, table='default'),
                      dict(marked, priority=5250, action='unreachable'), {'priority': 5270, 'src': 'all', 'table': 52}]
     actual = []
-    tables = {255: 'local', 254: 'main', 253: 'default'}
+    # iproute2 iprule.c prints table names/numbers as JSON strings, including Tailscale's "52".
+    tables = {255: 'local', 254: 'main', 253: 'default',
+              '255': 'local', '254': 'main', '253': 'default', '52': 52}
     for row in rows:
         if not isinstance(row, dict) or set(row) - {'priority', 'src', 'table', 'protocol',
                                                    'fwmark', 'fwmask', 'action'}:

package/backend-action/test_network_rule_diagnostics.py

@@ -12,6 +12,22 @@ from test_network_inventory import FakeHost, RULES
 
 
 class RuleDiagnosticTests(unittest.TestCase):
+    def test_iproute_decimal_table_strings_keep_exact_policy_semantics(self):
+        marked = {'src': 'all', 'fwmark': '0x80000', 'fwmask': '0xff0000'}
+        rules = [dict(row, table=str({'local': 255, 'main': 254, 'default': 253}[row['table']]))
+                 for row in RULES]
+        validate_rules(rules)
+        rules += [dict(marked, priority=5210, table='254'), dict(marked, priority=5230, table='253'),
+                  dict(marked, priority=5250, action='unreachable'),
+                  {'priority': 5270, 'src': 'all', 'table': '52'}]
+        validate_rules(rules)
+        for invalid in ('53', '052', '0x34', 'private table alias', 53, True):
+            changed = copy.deepcopy(rules)
+            changed[-1]['table'] = invalid
+            with self.subTest(table=invalid), self.assertRaises(InventoryFailure) as caught:
+                validate_rules(changed)
+            self.assertEqual(caught.exception.code, 'host_rules_unsupported_table')
+
     def test_each_rejected_shape_keeps_a_closed_reason_without_values(self):
         marked = {'src': 'all', 'fwmark': '0x80000', 'fwmask': '0xff0000'}
         valid = RULES + [dict(marked, priority=5210, table='main'), dict(marked, priority=5230, table='default'),

package/docs/BACKEND_NETWORKS.md

@@ -82,6 +82,9 @@ Raw container data, labels, environment, daemon configuration and command errors
 Policy-rule refusals use `host_rules_unsupported_<reason>` to distinguish count, fields, priority,
 source, table, structure, fwmark, fwmask, action and duplicate mismatches. These fixed classifications
 retain the strict supported-rule comparison and publish no rejected keys or values.
+The exact decimal-string spellings of supported table IDs are normalized because
+[iproute2 prints rule tables as JSON strings](https://github.com/iproute2/iproute2/blob/v6.8.0/ip/iprule.c#L370).
+This does not admit additional routing tables, aliases, priorities or forwarding policies.
 
 The deployment emits its own `gowalk-cicd/backend-networks.v1` receipt. The existing
 `backend_deploy_failed` phase remains `compose_up` on a preparation refusal. Normal public health,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.152",
+  "version": "1.0.154",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {