gowalk-cicd 1.0.182 → 1.0.184

package/README.md

@@ -1225,7 +1225,14 @@ commits completed part transfers with `uploaded: true`, following Apple's
 The IPA endpoint rejected an optional `sourceFileChecksums` SHA_256 object even though
 the generic schema lists that algorithm; the uploader no longer sends that attribute.
 A completed file is reused only when its content-derived filename and size match, and
-any returned file checksum is verified.
+any returned file checksum is verified. New receipts retain locally computed SHA-256 and
+MD5 so Apple's returned checksum can be compared with the exact transferred bytes.
+
+An upload summary can remain `PROCESSING` after Apple exposes a valid eligible build.
+Completion then requires the unique matching iOS build, marketing version, app and bundle,
+alongside the completed upload asset and matching checksum. A missing, pending, failed or
+ambiguous build remains unconfirmed. The receipt retains `upload_resource_state` separately
+from the verified completion state.
 
 A failed upload emits the typed `apple_build_upload_failed` error annotation with schema
 `gowalk-cicd/apple-build-upload-failed.v2`: `category` (`ipa_invalid`,
@@ -1235,11 +1242,77 @@ A failed upload emits the typed `apple_build_upload_failed` error annotation wit
 the receipt's own identifiers (`cfBundleVersion`, `upload_id`, `file_id`, `state`,
 `provider_status`, `provider_code`, `provider_pointer`). Exception text is never
 published. The job also retains the exact exported IPA as `apple-ipa-<run>-<attempt>`
-(7 days) so a continuation can complete that same upload identity instead of rebuilding
+(7 days), copied without byte changes to the safe archive member `app.ipa`, so punctuation
+in the exported filename cannot block retention. A continuation can complete that upload instead of rebuilding
 different bytes under the same number. Build numbers come from `/builds`,
 `/preReleaseVersions` **and** `/apps/{id}/buildUploads`, so an unfinished or refused
 reservation is never reused; delete such a reservation only after reading it back.
 
+When an iOS producer was cancelled **after** both `Build and transfer iOS binary` and
+`Retain Apple verification handoff` succeeded, version 1.0.183 provides explicit recovery:
+
+```bash
+node .github/actions/swift-app/scripts/apple_upload_recovery.cjs \
+  ORIGINAL_RUN_ID ORIGINAL_ATTEMPT DEPLOYMENT_ID HANDOFF_ARTIFACT_ID \
+  > "$RUNNER_TEMP/apple-upload-recovery.json"
+```
+
+Run this released helper in an authorized `workflow_dispatch` Actions job on the same
+repository's default branch, after checking out the adopted tooling. The job needs
+`actions: read`, `contents: read`, `deployments: write`, `GITHUB_TOKEN: ${{ github.token }}`
+and the existing `ASC_KEY_P8`, `ASC_KEY_ID`, `ASC_ISSUER_ID` secrets (or the prepared ASC key
+path). Serialize the recovery workflow with normal Mobile Deploy using its exact concurrency
+group and `cancel-in-progress: false`; this prevents a deploy from starting between the
+last provenance read and the receipt write. Use this workflow policy and job environment:
+
+```yaml
+on: workflow_dispatch
+permissions:
+  contents: read
+  actions: read
+  deployments: write
+concurrency:
+  group: mobile-deploy-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  recover:
+    if: ${{ github.ref_name == github.event.repository.default_branch }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    env:
+      GITHUB_TOKEN: ${{ github.token }}
+      ASC_KEY_P8: ${{ secrets.ASC_KEY_P8 }}
+      ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+      ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      # Invoke the command above with the four verified original identifiers,
+      # then retain its JSON with the pinned, guarded artifact uploader.
+```
+
+Retain `apple-upload-recovery.json` with the existing pinned, guarded artifact uploader.
+The command has no local receipt or caller-provided
+digest option: it downloads the exact original artifact, verifies GitHub's archive SHA-256,
+and accepts only its bounded `apple-verification.json` member. It authenticates the current
+dispatch separately from the original run, attempt, source, repository, branch and deployment.
+
+Recovery requires a terminal cancelled original run and iOS producer with those two
+successful steps in order. A later completed attempt may exist; an active latest attempt
+refuses, including a retry observed immediately before writing the receipt. Fresh Apple
+readback must prove the exact completed upload and file, matching bytes, eligible `VALID`
+build and matching app. Only then can the original deployment become `uploaded`; repeating
+recovery verifies the same evidence without another write. No binary is rebuilt or uploaded,
+and the old handoff's metadata and release notes are never replayed. Missing, expired or
+mismatched evidence remains refused; do not relabel a receipt or impersonate the original
+`GITHUB_*` environment. Normal delivery still refuses cancelled producers.
+
+Retain the recovery proof, then rerun the **whole original deployment workflow**. Its
+upload-once admission reuses the confirmed iOS receipt and skips the iOS binary. Follow that
+new attempt and any unrelated remaining jobs to completion; recovery does not change the
+original cancelled attempt's conclusion. Read current store state for remaining submission
+work without changing an already accepted submission. This exceptional command adds no
+normal delivery job, polling or latency.
+
 Flutter SDK setup retries interrupted manifest and archive GETs, with four attempts
 within 60 seconds for manifests or 30 minutes for archives, with an 8 GiB archive bound. Retries resume private bytes
 with HTTP Range; if the origin ignores Range, a bounded full restart is permitted. The completed archive

package/action/action.yml

@@ -825,17 +825,33 @@ runs:
     # A failed REST upload keeps the exact exported IPA next to its receipt, so a
     # continuation can resume or complete that same upload identity instead of
     # rebuilding different bytes under the number the receipt names.
-    - name: Retain the exported IPA for upload recovery
+    - name: Stage the exported IPA for upload recovery
+      id: ipa-recovery
       if: ${{ always() && inputs.archive == 'true' && inputs.upload == 'true'
             && (steps.upload.outcome != 'success' || inputs.defer-provider-verification == 'true') }}
+      shell: bash
+      run: |
+        shopt -s nullglob
+        ipas=("$RUNNER_TEMP"/export/*.ipa)
+        if [ "${#ipas[@]}" -ne 1 ]; then
+          echo '::error::apple_ipa_recovery_export_count_invalid'
+          exit 1
+        fi
+        retained="$RUNNER_TEMP/apple-ipa-recovery"
+        mkdir -p "$retained"
+        cp "${ipas[0]}" "$retained/app.ipa"
+        cmp -s "${ipas[0]}" "$retained/app.ipa"
+
+    - name: Retain the exported IPA for upload recovery
+      if: ${{ always() && steps.ipa-recovery.outcome == 'success' }}
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
       env:
         NODE_OPTIONS: --require "${{ env.SWIFT_APP_ACTION }}/scripts/artifact_env.cjs"
       with:
         name: apple-ipa-${{ github.run_id }}-${{ github.run_attempt }}
-        path: ${{ runner.temp }}/export/*.ipa
+        path: ${{ runner.temp }}/apple-ipa-recovery/app.ipa
         compression-level: 0 # An IPA is already a ZIP; avoid duplicate compression on the Mac.
-        if-no-files-found: ignore
+        if-no-files-found: error
         retention-days: 7
 
     # The whatsNew backstop. An empty "What's New" makes a version

package/action/scripts/apple_upload_handoff.cjs

@@ -9,22 +9,12 @@ const positive = value => Number.isSafeInteger(value) && value > 0;
 const id = value => typeof value === 'string' && /^[A-Za-z0-9-]{1,64}$/.test(value);
 const fail = code => { throw Error(`apple_upload_verify_${code}`); };
 
-function read(path, digest, attempt, env = process.env) {
-  if (fs.statSync(path).size > 2 * 1024 * 1024) fail('handoff_size');
-  const bytes = fs.readFileSync(path);
-  if (bytes.length > 2 * 1024 * 1024 || !/^[a-f0-9]{64}$/.test(digest || '') ||
-      createHash('sha256').update(bytes).digest('hex') !== digest) fail('handoff_digest');
-  const value = JSON.parse(bytes), owner = value.owner || {}, r = value.receipt || {}, m = value.metadata || {};
-  const event = JSON.parse(fs.readFileSync(env.GITHUB_EVENT_PATH, 'utf8'));
-  if (value.schema !== SCHEMA || owner.repository !== env.GITHUB_REPOSITORY ||
+function validate(value) {
+  const owner = value?.owner || {}, r = value?.receipt || {}, m = value?.metadata || {};
+  if (value?.schema !== SCHEMA ||
       !/^[\w.-]+\/[\w.-]+$/.test(owner.repository || '') || !/^[a-f0-9]{40}$/.test(owner.source_sha || '') ||
-      owner.source_sha !== env.GITHUB_SHA || owner.ref !== env.GITHUB_REF || !owner.ref?.startsWith('refs/heads/') ||
-      owner.ref !== `refs/heads/${event.repository?.default_branch}` ||
-      !['push', 'workflow_dispatch'].includes(owner.event) || owner.event !== env.GITHUB_EVENT_NAME ||
-      !positive(owner.run_id) || owner.run_id !== Number(env.GITHUB_RUN_ID) || !positive(owner.run_attempt) ||
-      !positive(attempt) || !positive(Number(env.GITHUB_RUN_ATTEMPT)) ||
-      owner.run_attempt !== attempt || attempt > Number(env.GITHUB_RUN_ATTEMPT) ||
-      !positive(owner.deployment_id) || owner.deployment_id !== Number(env.MOBILE_RELEASE_DEPLOYMENT_ID)) {
+      !owner.ref?.startsWith('refs/heads/') || !['push', 'workflow_dispatch'].includes(owner.event) ||
+      !positive(owner.run_id) || !positive(owner.run_attempt) || !positive(owner.deployment_id)) {
     fail('handoff_owner');
   }
   if (r.schema !== 'gowalk-cicd/apple-build-upload-receipt.v1' || r.stage !== 'transferred' ||
@@ -34,12 +24,29 @@ function read(path, digest, attempt, env = process.env) {
       !/^[a-f0-9]{64}$/.test(r.sha256 || '') || r.fileName !== `${r.sha256}.ipa` || !positive(r.fileSize)) {
     fail('handoff_receipt');
   }
+  if (r.md5 !== undefined && (typeof r.md5 !== 'string' || !/^[a-f0-9]{32}$/.test(r.md5))) fail('handoff_receipt');
   if (typeof m.enabled !== 'boolean' || typeof m.only_if_empty !== 'boolean' ||
       typeof m.notes !== 'string' || Buffer.byteLength(m.notes) > 1024 * 1024 || m.notes.includes('\0') ||
       !/^[A-Za-z0-9-]{2,35}$/.test(m.locale || '') || m.enabled && !id(m.version_id)) fail('handoff_metadata');
   return value;
 }
 
+function read(path, digest, attempt, env = process.env) {
+  if (fs.statSync(path).size > 2 * 1024 * 1024) fail('handoff_size');
+  const bytes = fs.readFileSync(path);
+  if (bytes.length > 2 * 1024 * 1024 || !/^[a-f0-9]{64}$/.test(digest || '') ||
+      createHash('sha256').update(bytes).digest('hex') !== digest) fail('handoff_digest');
+  const value = validate(JSON.parse(bytes)), owner = value.owner;
+  const event = JSON.parse(fs.readFileSync(env.GITHUB_EVENT_PATH, 'utf8'));
+  if (owner.repository !== env.GITHUB_REPOSITORY || owner.source_sha !== env.GITHUB_SHA ||
+      owner.ref !== env.GITHUB_REF || owner.ref !== `refs/heads/${event.repository?.default_branch}` ||
+      owner.event !== env.GITHUB_EVENT_NAME || owner.run_id !== Number(env.GITHUB_RUN_ID) ||
+      !positive(attempt) || !positive(Number(env.GITHUB_RUN_ATTEMPT)) ||
+      owner.run_attempt !== attempt || attempt > Number(env.GITHUB_RUN_ATTEMPT) ||
+      owner.deployment_id !== Number(env.MOBILE_RELEASE_DEPLOYMENT_ID)) fail('handoff_owner');
+  return value;
+}
+
 function transferred(job) {
   if (!Array.isArray(job.steps)) return false;
   const selected = ['Build and transfer iOS binary', 'Retain Apple verification handoff'].map(name =>
@@ -49,7 +56,7 @@ function transferred(job) {
   return selected[0][0].number < selected[1][0].number;
 }
 
-async function verifyProducer(value, artifactId, api = github) {
+async function verifyProducer(value, artifactId, api = github, recoverCancelled = false) {
   if (!positive(artifactId)) fail('artifact_identity');
   const o = value.owner;
   const run = await api.request('GET', `/actions/runs/${o.run_id}/attempts/${o.run_attempt}`);
@@ -57,12 +64,21 @@ async function verifyProducer(value, artifactId, api = github) {
       run.path !== '.github/workflows/deploy.yml' || run.event !== o.event ||
       `refs/heads/${run.head_branch}` !== o.ref || run.repository?.full_name !== o.repository ||
       run.head_repository?.full_name !== o.repository) fail('producer_run');
+  if (recoverCancelled) {
+    const latest = await api.request('GET', `/actions/runs/${o.run_id}`);
+    if (run.status !== 'completed' || run.conclusion !== 'cancelled' || latest.id !== o.run_id ||
+        latest.status !== 'completed' || !positive(latest.run_attempt) || latest.run_attempt < o.run_attempt ||
+        latest.head_sha !== o.source_sha || latest.path !== run.path || latest.event !== o.event ||
+        latest.head_branch !== run.head_branch || latest.repository?.full_name !== o.repository ||
+        latest.head_repository?.full_name !== o.repository) fail('cancelled_producer_run');
+  }
   const result = await api.request('GET', `/actions/runs/${o.run_id}/attempts/${o.run_attempt}/jobs?per_page=100`);
   if (!Array.isArray(result.jobs) || result.jobs.length >= 100) fail('producer_jobs');
   const jobs = result.jobs.filter(job => job.name === 'iOS TestFlight' || job.name?.endsWith('/ iOS TestFlight'));
   // A later symbol-retention failure does not undo these exact completed steps.
   // The producer's original failure remains red; only Apple delivery is reconciled here.
-  if (jobs.length !== 1 || jobs[0].status !== 'completed' || !['success', 'failure'].includes(jobs[0].conclusion) ||
+  const conclusions = recoverCancelled ? ['cancelled'] : ['success', 'failure'];
+  if (jobs.length !== 1 || jobs[0].status !== 'completed' || !conclusions.includes(jobs[0].conclusion) ||
       jobs[0].head_sha !== o.source_sha || !transferred(jobs[0])) fail('producer_job');
   const artifact = await api.request('GET', `/actions/artifacts/${artifactId}`);
   if (artifact.id !== artifactId || artifact.expired !== false || artifact.workflow_run?.id !== o.run_id ||
@@ -100,4 +116,4 @@ function metadata(value, env = process.env) {
   }
 }
 
-module.exports = {read, verifyProducer, phase, metadata, fail};
+module.exports = {read, validate, verifyProducer, phase, metadata, fail};

package/action/scripts/apple_upload_handoff.py

@@ -54,7 +54,10 @@ def prepare():
 def write(path, handoff, receipt):
     if receipt.get("stage") != "transferred" or "\n" in str(path) or "\r" in str(path):
         raise ValueError("apple_handoff_transfer_unconfirmed")
-    handoff = {**handoff, "receipt": {name: receipt[name] for name in FIELDS}}
+    fields = {name: receipt[name] for name in FIELDS}
+    if "md5" in receipt:
+        fields["md5"] = receipt["md5"]
+    handoff = {**handoff, "receipt": fields}
     data = (json.dumps(handoff, sort_keys=True, separators=(",", ":")) + "\n").encode()
     path.write_bytes(data)
     digest = hashlib.sha256(data).hexdigest()

package/action/scripts/apple_upload_proof.cjs

@@ -0,0 +1,117 @@
+/* Read-only proof of one transferred IPA, including Apple's separately processed build. */
+'use strict';
+const identifier = value => typeof value === 'string' && /^[A-Za-z0-9-]{1,64}$/.test(value);
+
+function entity(response, fail, code) {
+  const row = response?.data;
+  if (!row || typeof row !== 'object' || Array.isArray(row) ||
+      row.attributes !== undefined && (!row.attributes || typeof row.attributes !== 'object') ||
+      row.relationships !== undefined && (!row.relationships || typeof row.relationships !== 'object')) fail(code);
+  return row;
+}
+
+function collection(response, fail, code) {
+  const rows = response?.data, total = response?.meta?.paging?.total;
+  if (!Array.isArray(rows) || rows.some(row => !row || typeof row !== 'object' || Array.isArray(row)) ||
+      rows.length >= 200 || !response.links || typeof response.links !== 'object' ||
+      Array.isArray(response.links) || response.links.next ||
+      total !== undefined && (!Number.isSafeInteger(total) || total !== rows.length)) fail(code);
+  return rows;
+}
+
+function checksum(attributes, receipt, fail) {
+  const checksums = attributes.sourceFileChecksums;
+  if (checksums !== undefined && (!checksums || typeof checksums !== 'object' || Array.isArray(checksums))) {
+    fail('file_checksum_unverified');
+  }
+  const file = checksums?.file;
+  if (file === undefined) return;
+  const digest = file?.algorithm === 'SHA_256' ? receipt.sha256 :
+    file?.algorithm === 'MD5' ? receipt.md5 : null;
+  const width = file?.algorithm === 'SHA_256' ? 64 : 32;
+  if (typeof digest !== 'string' || !new RegExp(`^[a-f0-9]{${width}}$`).test(digest)) {
+    fail('file_checksum_unverified');
+  }
+  const values = [digest, digest.toUpperCase(), Buffer.from(digest, 'hex').toString('base64')];
+  if (!values.includes(file.hash)) fail('file_checksum_unverified');
+}
+
+async function fileProof(receipt, get, fail) {
+  const response = await get(`/buildUploads/${receipt.upload_id}/buildUploadFiles`);
+  const assets = collection(response, fail, 'file_membership').filter(row => row.attributes?.assetType === 'ASSET');
+  if (assets.length !== 1 || assets[0].id !== receipt.file_id) fail('file_membership');
+  const file = entity(await get(`/buildUploadFiles/${receipt.file_id}`), fail, 'file_unverified');
+  const attrs = file.attributes || {};
+  if (file?.id !== receipt.file_id || attrs.assetType !== 'ASSET' ||
+      attrs.fileName !== receipt.fileName || attrs.fileSize !== receipt.fileSize) fail('file_unverified');
+  if (attrs.assetDeliveryState?.state === 'FAILED' || attrs.assetDeliveryState?.errors?.length) {
+    fail('processing_failed');
+  }
+  if (attrs.assetDeliveryState?.state !== 'COMPLETE') return false;
+  checksum(attrs, receipt, fail);
+  return true;
+}
+
+async function inventoryBuild(receipt, get, fail) {
+  const query = new URLSearchParams({'filter[app]': receipt.app_id, 'filter[version]': receipt.cfBundleVersion,
+    include: 'preReleaseVersion,app', limit: '200'});
+  const response = await get(`/builds?${query}`), rows = collection(response, fail, 'build_inventory_unverified');
+  const included = response.included;
+  if (!Array.isArray(included) || included.some(row => !row || typeof row !== 'object' || Array.isArray(row))) {
+    fail('build_inventory_unverified');
+  }
+  const ids = new Set(), matches = [];
+  for (const row of rows) {
+    if (!identifier(row.id) || ids.has(row.id) || row.attributes?.version !== receipt.cfBundleVersion) {
+      fail('build_inventory_unverified');
+    }
+    ids.add(row.id);
+    const trainId = row.relationships?.preReleaseVersion?.data?.id;
+    const appId = row.relationships?.app?.data?.id;
+    const trains = included.filter(item => item.type === 'preReleaseVersions' && item.id === trainId);
+    const apps = included.filter(item => item.type === 'apps' && item.id === appId);
+    if (!identifier(trainId) || trains.length !== 1 || apps.length !== 1 || appId !== receipt.app_id ||
+        apps[0].attributes?.bundleId !== receipt.bundle_id) fail('build_inventory_unverified');
+    if (trains[0].attributes?.version === receipt.cfBundleShortVersionString &&
+        trains[0].attributes?.platform === 'IOS') matches.push(row.id);
+  }
+  if (matches.length > 1) fail('build_ambiguous');
+  return matches[0] || null;
+}
+
+async function buildProof(buildId, receipt, get, fail) {
+  const build = entity(await get(`/builds/${buildId}`), fail, 'build_unverified');
+  const attrs = build.attributes || {};
+  if (build?.id !== buildId || attrs.version !== receipt.cfBundleVersion) fail('build_unverified');
+  if (['FAILED', 'INVALID'].includes(attrs.processingState)) fail('processing_failed');
+  if (attrs.processingState === 'PROCESSING') return null;
+  if (attrs.processingState !== 'VALID' || attrs.buildAudienceType !== 'APP_STORE_ELIGIBLE') {
+    fail('build_unverified');
+  }
+  const app = entity(await get(`/builds/${buildId}/app`), fail, 'app_unverified');
+  if (app?.id !== receipt.app_id || app.attributes?.bundleId !== receipt.bundle_id) fail('app_unverified');
+  const train = entity(await get(`/builds/${buildId}/preReleaseVersion`), fail, 'train_unverified');
+  if (!identifier(train?.id) || train.attributes?.platform !== 'IOS' ||
+      train.attributes?.version !== receipt.cfBundleShortVersionString) fail('train_unverified');
+  return {build_id: buildId, app_id: app.id, version: receipt.cfBundleShortVersionString,
+    build: receipt.cfBundleVersion, upload_id: receipt.upload_id};
+}
+
+async function observe(receipt, get, fail) {
+  const upload = entity(await get(`/buildUploads/${receipt.upload_id}?include=build`), fail, 'upload_unverified');
+  const attrs = upload?.attributes || {}, state = attrs.state?.state;
+  if (upload?.id !== receipt.upload_id || attrs.platform !== 'IOS' ||
+      attrs.cfBundleVersion !== receipt.cfBundleVersion ||
+      attrs.cfBundleShortVersionString !== receipt.cfBundleShortVersionString) fail('upload_unverified');
+  if (state === 'FAILED' || attrs.state?.errors?.length) fail('processing_failed');
+  if (!['COMPLETE', 'PROCESSING'].includes(state)) return null;
+  if (!await fileProof(receipt, get, fail)) return null;
+  const relationship = upload.relationships?.build?.data;
+  if (relationship && !identifier(relationship.id)) fail('build_unverified');
+  const buildId = relationship?.id || await inventoryBuild(receipt, get, fail);
+  if (!buildId) return null;
+  const proof = await buildProof(buildId, receipt, get, fail);
+  return proof && {...proof, upload_resource_state: state};
+}
+
+module.exports = {observe};

package/action/scripts/apple_upload_proof.py

@@ -0,0 +1,157 @@
+"""Read-only exact upload/file/build proof for the legacy synchronous Python entrypoint."""
+import base64
+import re
+
+from upload_receipt import UploadError
+
+
+def refuse(code):
+    raise UploadError(code, "Apple upload completion was not independently verified")
+
+
+def entity(response, code):
+    row = response.get("data") if isinstance(response, dict) else None
+    if (not isinstance(row, dict) or not isinstance(row.get("attributes", {}), dict)
+            or not isinstance(row.get("relationships", {}), dict)):
+        refuse(code)
+    return row
+
+
+def collection(response, code):
+    if not isinstance(response, dict):
+        refuse(code)
+    rows, links = response.get("data"), response.get("links")
+    total = (response.get("meta") or {}).get("paging", {}).get("total")
+    if (not isinstance(rows, list) or any(not isinstance(row, dict)
+            or not isinstance(row.get("attributes", {}), dict)
+            or not isinstance(row.get("relationships", {}), dict) for row in rows)
+            or len(rows) >= 200 or not isinstance(links, dict) or links.get("next")
+            or total is not None and (type(total) is not int or total != len(rows))):
+        refuse(code)
+    return rows
+
+
+def checksum(attributes, receipt):
+    checksums = attributes.get("sourceFileChecksums", {})
+    if not isinstance(checksums, dict):
+        refuse("file_checksum_unverified")
+    if "file" not in checksums:
+        return
+    file = checksums["file"]
+    if not isinstance(file, dict):
+        refuse("file_checksum_unverified")
+    algorithm = file.get("algorithm")
+    digest = receipt.get("sha256") if algorithm == "SHA_256" else receipt.get("md5") if algorithm == "MD5" else None
+    width = 64 if algorithm == "SHA_256" else 32
+    if not isinstance(digest, str) or not re.fullmatch(r"[a-f0-9]{" + str(width) + "}", digest):
+        refuse("file_checksum_unverified")
+    values = (digest, digest.upper(), base64.b64encode(bytes.fromhex(digest)).decode())
+    if file.get("hash") not in values:
+        refuse("file_checksum_unverified")
+
+
+def file_proof(receipt, api):
+    response = api("GET", f"/buildUploads/{receipt['upload_id']}/buildUploadFiles")
+    assets = [row for row in collection(response, "file_membership")
+              if (row.get("attributes") or {}).get("assetType") == "ASSET"]
+    if len(assets) != 1 or assets[0].get("id") != receipt["file_id"]:
+        refuse("file_membership")
+    file = entity(api("GET", f"/buildUploadFiles/{receipt['file_id']}"), "file_unverified")
+    attrs = file.get("attributes") or {}
+    if (file.get("id") != receipt["file_id"] or attrs.get("assetType") != "ASSET"
+            or any(attrs.get(key) != receipt[key] for key in ("fileName", "fileSize"))):
+        refuse("file_unverified")
+    state = attrs.get("assetDeliveryState") or {}
+    if not isinstance(state, dict):
+        refuse("file_unverified")
+    if state.get("state") == "FAILED" or state.get("errors"):
+        refuse("processing_failed")
+    if state.get("state") != "COMPLETE":
+        return False
+    checksum(attrs, receipt)
+    return True
+
+
+def inventory_build(receipt, api):
+    response = api("GET", "/builds", params={"filter[app]": receipt["app_id"],
+                   "filter[version]": receipt["cfBundleVersion"], "include": "preReleaseVersion,app", "limit": 200})
+    rows = collection(response, "build_inventory_unverified")
+    included = response.get("included")
+    if (not isinstance(included, list) or any(not isinstance(item, dict)
+            or not isinstance(item.get("attributes", {}), dict) for item in included)):
+        refuse("build_inventory_unverified")
+    identifiers, matches = set(), []
+    for row in rows:
+        build_id = row.get("id")
+        if (not isinstance(build_id, str) or not re.fullmatch(r"[A-Za-z0-9-]{1,64}", build_id)
+                or build_id in identifiers
+                or (row.get("attributes") or {}).get("version") != receipt["cfBundleVersion"]):
+            refuse("build_inventory_unverified")
+        identifiers.add(build_id)
+        relationships = row.get("relationships") or {}
+        for name in ("preReleaseVersion", "app"):
+            link = relationships.get(name)
+            if (not isinstance(link, dict) or not isinstance(link.get("data"), dict)):
+                refuse("build_inventory_unverified")
+        train_id = ((relationships.get("preReleaseVersion") or {}).get("data") or {}).get("id")
+        app_id = ((relationships.get("app") or {}).get("data") or {}).get("id")
+        trains = [item for item in included if item.get("type") == "preReleaseVersions" and item.get("id") == train_id]
+        apps = [item for item in included if item.get("type") == "apps" and item.get("id") == app_id]
+        if (not isinstance(train_id, str) or not re.fullmatch(r"[A-Za-z0-9-]{1,64}", train_id)
+                or len(trains) != 1 or len(apps) != 1 or app_id != receipt["app_id"]
+                or (apps[0].get("attributes") or {}).get("bundleId") != receipt["bundle_id"]):
+            refuse("build_inventory_unverified")
+        attrs = trains[0].get("attributes") or {}
+        if attrs.get("version") == receipt["cfBundleShortVersionString"] and attrs.get("platform") == "IOS":
+            matches.append(build_id)
+    if len(matches) > 1:
+        refuse("build_ambiguous")
+    return matches[0] if matches else None
+
+
+def build_proof(build_id, receipt, api):
+    build = entity(api("GET", f"/builds/{build_id}"), "build_unverified")
+    attrs = build.get("attributes") or {}
+    if build.get("id") != build_id or attrs.get("version") != receipt["cfBundleVersion"]:
+        refuse("build_unverified")
+    if attrs.get("processingState") in ("FAILED", "INVALID"):
+        refuse("processing_failed")
+    if attrs.get("processingState") == "PROCESSING":
+        return None
+    if attrs.get("processingState") != "VALID" or attrs.get("buildAudienceType") != "APP_STORE_ELIGIBLE":
+        refuse("build_unverified")
+    app = entity(api("GET", f"/builds/{build_id}/app"), "app_unverified")
+    if app.get("id") != receipt["app_id"] or (app.get("attributes") or {}).get("bundleId") != receipt["bundle_id"]:
+        refuse("app_unverified")
+    train = entity(api("GET", f"/builds/{build_id}/preReleaseVersion"), "train_unverified")
+    train_attrs = train.get("attributes") or {}
+    if (not isinstance(train.get("id"), str) or not re.fullmatch(r"[A-Za-z0-9-]{1,64}", train["id"])
+            or train_attrs.get("platform") != "IOS"
+            or train_attrs.get("version") != receipt["cfBundleShortVersionString"]):
+        refuse("train_unverified")
+    return {"build_id": build_id}
+
+
+def observe(receipt, api):
+    response = api("GET", f"/buildUploads/{receipt['upload_id']}", params={"include": "build"})
+    upload = entity(response, "upload_unverified")
+    attrs = upload.get("attributes") or {}
+    state = attrs.get("state") or {}
+    if not isinstance(state, dict):
+        refuse("upload_unverified")
+    if (upload.get("id") != receipt["upload_id"] or attrs.get("platform") != "IOS"
+            or any(attrs.get(key) != receipt[key] for key in ("cfBundleVersion", "cfBundleShortVersionString"))):
+        refuse("upload_unverified")
+    if state.get("state") == "FAILED" or state.get("errors"):
+        refuse("processing_failed")
+    if state.get("state") not in ("COMPLETE", "PROCESSING") or not file_proof(receipt, api):
+        return None, state.get("state")
+    link = (upload.get("relationships") or {}).get("build")
+    if link is not None and not isinstance(link, dict):
+        refuse("build_unverified")
+    relationship = (link or {}).get("data")
+    if relationship and (not isinstance(relationship, dict) or not isinstance(relationship.get("id"), str)
+                         or not re.fullmatch(r"[A-Za-z0-9-]{1,64}", relationship["id"])):
+        refuse("build_unverified")
+    build_id = relationship["id"] if relationship else inventory_build(receipt, api)
+    return (build_proof(build_id, receipt, api) if build_id else None), state.get("state")

package/action/scripts/apple_upload_recovery.cjs

@@ -0,0 +1,126 @@
+/* Explicit Actions recovery of a cancelled producer's authenticated handoff; never upload or metadata. */
+'use strict';
+const fs = require('node:fs');
+const {createHash} = require('node:crypto');
+const {inflateRawSync} = require('node:zlib');
+const github = require('./mobile_release_api.cjs');
+const handoff = require('./apple_upload_handoff.cjs');
+const verifier = require('./apple_upload_verify.cjs');
+const LIMIT = 2 * 1024 * 1024;
+const positive = value => Number.isSafeInteger(value) && value > 0;
+const fail = code => handoff.fail(`recovery_${code}`);
+
+// This archive contains one fixed JSON member. Parse in memory; never extract paths or trust a local receipt.
+function unpack(bytes) {
+  try {
+    if (bytes.length > LIMIT) fail('artifact_size');
+    const end = bytes.lastIndexOf(Buffer.from('504b0506', 'hex'));
+    if (end < 0 || end + 22 + bytes.readUInt16LE(end + 20) !== bytes.length ||
+        bytes.readUInt16LE(end + 4) !== 0 || bytes.readUInt16LE(end + 6) !== 0 ||
+        bytes.readUInt16LE(end + 8) !== 1 || bytes.readUInt16LE(end + 10) !== 1) fail('archive_invalid');
+    const at = bytes.readUInt32LE(end + 16), directorySize = bytes.readUInt32LE(end + 12);
+    if (at + directorySize !== end || bytes.readUInt32LE(at) !== 0x02014b50) fail('archive_invalid');
+    const flags = bytes.readUInt16LE(at + 8), method = bytes.readUInt16LE(at + 10);
+    const packed = bytes.readUInt32LE(at + 20), size = bytes.readUInt32LE(at + 24);
+    const length = bytes.readUInt16LE(at + 28), name = bytes.subarray(at + 46, at + 46 + length);
+    const mode = (bytes.readUInt32LE(at + 38) >>> 16) & 0xf000;
+    if (name.toString('utf8') !== 'apple-verification.json' || flags & 1 || ![0, 8].includes(method) ||
+        ![0, 0x8000].includes(mode) || size > LIMIT || packed > LIMIT ||
+        46 + length + bytes.readUInt16LE(at + 30) + bytes.readUInt16LE(at + 32) !== directorySize ||
+        bytes.readUInt16LE(at + 34) !== 0 || bytes.readUInt32LE(at + 42) !== 0 ||
+        bytes.readUInt32LE(0) !== 0x04034b50 || bytes.readUInt16LE(6) !== flags ||
+        bytes.readUInt16LE(8) !== method) fail('archive_invalid');
+    const localLength = bytes.readUInt16LE(26), start = 30 + localLength + bytes.readUInt16LE(28);
+    if (!bytes.subarray(30, 30 + localLength).equals(name) || start + packed > at) fail('archive_invalid');
+    const compressed = bytes.subarray(start, start + packed);
+    const content = method ? inflateRawSync(compressed, {maxOutputLength: LIMIT}) : compressed;
+    if (content.length !== size || content.length > LIMIT) fail('archive_invalid');
+    return content;
+  } catch { fail('archive_invalid'); }
+}
+
+async function download(artifact, env = process.env, fetcher = fetch) {
+  if (!positive(artifact?.id) || !/^sha256:[a-f0-9]{64}$/.test(artifact.digest || '') ||
+      !positive(artifact.size_in_bytes) || artifact.size_in_bytes > LIMIT ||
+      !/^[\w.-]+\/[\w.-]+$/.test(env.GITHUB_REPOSITORY || '')) fail('artifact_invalid');
+  const signal = AbortSignal.timeout(30000);
+  const response = await fetcher(`https://api.github.com/repos/${env.GITHUB_REPOSITORY}/actions/artifacts/${artifact.id}/zip`,
+    {redirect: 'manual', signal, headers: {Authorization: `Bearer ${env.GITHUB_TOKEN || ''}`,
+      'User-Agent': 'gowalk-cicd', Accept: 'application/vnd.github+json'}});
+  const url = new URL(response.headers.get('location') || 'https://invalid.invalid');
+  if (response.status !== 302 || url.protocol !== 'https:' || url.username || url.password ||
+      url.port || url.hash || !/(?:\.blob\.core\.windows\.net|\.githubusercontent\.com)$/.test(url.hostname)) {
+    fail('artifact_unavailable');
+  }
+  // The signed storage URL receives no repository credential, and cannot redirect again.
+  const body = await fetcher(url, {redirect: 'error', signal});
+  if (!body.ok || !body.body) fail('artifact_unavailable');
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of body.body) {
+    size += chunk.length;
+    if (size > LIMIT || size > artifact.size_in_bytes) fail('artifact_size');
+    chunks.push(chunk);
+  }
+  const bytes = Buffer.concat(chunks);
+  if (bytes.length !== artifact.size_in_bytes ||
+      `sha256:${createHash('sha256').update(bytes).digest('hex')}` !== artifact.digest) fail('artifact_digest');
+  return unpack(bytes);
+}
+
+async function current(env, api) {
+  const runId = Number(env.GITHUB_RUN_ID), attempt = Number(env.GITHUB_RUN_ATTEMPT);
+  const event = JSON.parse(fs.readFileSync(env.GITHUB_EVENT_PATH, 'utf8'));
+  const repository = env.GITHUB_REPOSITORY, branch = event.repository?.default_branch;
+  if (env.GITHUB_ACTIONS !== 'true' || env.GITHUB_EVENT_NAME !== 'workflow_dispatch' ||
+      !/^[\w.-]+\/[\w.-]+$/.test(repository || '') || !positive(runId) || !positive(attempt) ||
+      !branch || env.GITHUB_REF !== `refs/heads/${branch}` || !/^[a-f0-9]{40}$/.test(env.GITHUB_SHA || '')) {
+    fail('caller_invalid');
+  }
+  const run = await api.request('GET', `/actions/runs/${runId}/attempts/${attempt}`);
+  if (run.id !== runId || run.run_attempt !== attempt || run.status !== 'in_progress' ||
+      run.event !== 'workflow_dispatch' || run.head_branch !== branch || run.head_sha !== env.GITHUB_SHA ||
+      run.repository?.full_name !== repository || run.head_repository?.full_name !== repository ||
+      !/^\.github\/workflows\/[\w.-]+\.ya?ml$/.test(run.path || '') ||
+      env.GITHUB_WORKFLOW_REF !== `${repository}/${run.path}@${env.GITHUB_REF}`) fail('caller_unverified');
+  return {run_id: runId, run_attempt: attempt, repository, ref: env.GITHUB_REF};
+}
+
+async function recover({runId, attempt, deploymentId, artifactId}, dependencies = {}) {
+  if (![runId, attempt, deploymentId, artifactId].every(positive)) fail('arguments');
+  const env = dependencies.env || process.env, api = dependencies.api || github;
+  const caller = await current(env, api);
+  if (runId === caller.run_id) fail('caller_invalid');
+  const artifact = await api.request('GET', `/actions/artifacts/${artifactId}`);
+  if (artifact.id !== artifactId || artifact.expired !== false || artifact.workflow_run?.id !== runId ||
+      artifact.name !== `apple-verification-${runId}-${attempt}`) fail('artifact_identity');
+  const bytes = await download(artifact, env, dependencies.fetch || fetch);
+  let parsed;
+  try { parsed = JSON.parse(bytes.toString('utf8')); } catch { fail('handoff_invalid'); }
+  const value = handoff.validate(parsed), owner = value.owner;
+  if (owner.repository !== caller.repository || owner.ref !== caller.ref || owner.run_id !== runId ||
+      owner.run_attempt !== attempt || owner.deployment_id !== deploymentId ||
+      owner.source_sha !== artifact.workflow_run?.head_sha) fail('handoff_owner');
+  const result = await verifier.verify(value, artifactId, 900, {...dependencies, api, recoverCancelled: true});
+  return {...result, schema: 'gowalk-cicd/apple-upload-recovered.v1', producer_run: runId,
+    repository: owner.repository, producer_source_sha: owner.source_sha,
+    producer_ref: owner.ref, producer_event: owner.event,
+    artifact_id: artifactId, artifact_digest: artifact.digest,
+    handoff_sha256: createHash('sha256').update(bytes).digest('hex'),
+    ipa_sha256: value.receipt.sha256, file_id: value.receipt.file_id,
+    recovery_run: caller.run_id, recovery_attempt: caller.run_attempt};
+}
+
+async function main() {
+  if (process.argv.length !== 6) fail('arguments');
+  const [runId, attempt, deploymentId, artifactId] = process.argv.slice(2).map(Number);
+  console.log(JSON.stringify(await recover({runId, attempt, deploymentId, artifactId})));
+}
+
+if (require.main === module) main().catch(error => {
+  const code = /^(apple_upload_verify|apple_upload_reconcile|mobile_release)_[a-z0-9_]+$/.test(error?.message || '') ?
+    error.message : 'apple_upload_verify_recovery_unavailable';
+  console.error('::error title=apple_upload_recovery_refused::' + JSON.stringify({code}));
+  process.exitCode = 1;
+});
+module.exports = {unpack, download, current, recover};

package/action/scripts/apple_upload_verify.cjs

@@ -5,6 +5,7 @@ const {parseArgs} = require('node:util');
 const {setTimeout: delay} = require('node:timers/promises');
 const github = require('./mobile_release_api.cjs');
 const apple = require('./reconcile_apple_upload.cjs');
+const provider = require('./apple_upload_proof.cjs');
 const handoff = require('./apple_upload_handoff.cjs');
 
 function credential(env = process.env) {
@@ -15,25 +16,7 @@ function credential(env = process.env) {
 }
 
 async function observe(receipt, get) {
-  const path = `/buildUploads/${receipt.upload_id}?include=build`, response = await get(path);
-  const upload = response.data, attrs = upload?.attributes || {};
-  if (upload?.id !== receipt.upload_id || attrs.cfBundleVersion !== receipt.cfBundleVersion ||
-      attrs.cfBundleShortVersionString !== receipt.cfBundleShortVersionString) handoff.fail('upload_identity');
-  if (attrs.state?.state === 'FAILED') handoff.fail('processing_failed');
-  if (attrs.state?.state !== 'COMPLETE') return null;
-  const buildId = upload.relationships?.build?.data?.id;
-  if (!/^[A-Za-z0-9-]{1,64}$/.test(buildId || '')) handoff.fail('build_identity');
-  const buildPath = `/builds/${buildId}`, build = await get(buildPath);
-  if (['FAILED', 'INVALID'].includes(build.data?.attributes?.processingState)) handoff.fail('processing_failed');
-  if (build.data?.attributes?.processingState === 'PROCESSING') return null;
-  const files = await get(`/buildUploads/${receipt.upload_id}/buildUploadFiles`);
-  const assets = files.data?.filter(row => row.attributes?.assetType === 'ASSET');
-  if (!Array.isArray(assets) || files.links?.next || assets.length !== 1 || assets[0].id !== receipt.file_id) {
-    handoff.fail('file_membership');
-  }
-  // Preserve the existing independent complete-file, VALID/eligible build and actual app readbacks.
-  return apple.verifyApple(receipt, requested => requested === path ? response :
-    requested === buildPath ? build : get(requested));
+  return provider.observe(receipt, get, handoff.fail);
 }
 
 async function verify(value, artifactId, timeout, dependencies = {}) {
@@ -42,7 +25,7 @@ async function verify(value, artifactId, timeout, dependencies = {}) {
   const sleep = dependencies.sleep || delay, started = now(), deadline = started + timeout * 1000;
   const key = dependencies.get ? null : credential();
   const get = dependencies.get || (path => apple.appleGet(path, key, Math.max(1, Math.min(30000, deadline - now()))));
-  await handoff.verifyProducer(value, artifactId, api);
+  await handoff.verifyProducer(value, artifactId, api, dependencies.recoverCancelled === true);
   await handoff.phase(value, api);
   let proof;
   do {
@@ -52,6 +35,8 @@ async function verify(value, artifactId, timeout, dependencies = {}) {
     await sleep(Math.min(10000, deadline - now()));
   } while (now() < deadline);
   if (!proof) handoff.fail('processing_pending');
+  // Explicit historical recovery rechecks its terminal producer before the only write.
+  if (dependencies.recoverCancelled === true) await handoff.verifyProducer(value, artifactId, api, true);
   const prior = await handoff.phase(value, api);
   if (prior === 'uploading') await api.status(value.owner.deployment_id, 'uploaded', 'success');
   if (await handoff.phase(value, api) !== 'uploaded') handoff.fail('write_unconfirmed');
@@ -69,7 +54,8 @@ async function main() {
   handoff.metadata(value);
   const receiptPath = `${positionals[0]}.upload-receipt.json`;
   fs.writeFileSync(receiptPath, JSON.stringify({...value.receipt, stage: 'complete', state: 'COMPLETE',
-    build_id: proof.build_id, processing_seconds: proof.processing_seconds}, null, 2) + '\n');
+    build_id: proof.build_id, upload_resource_state: proof.upload_resource_state,
+    processing_seconds: proof.processing_seconds}, null, 2) + '\n');
   if (/[\r\n]/.test(receiptPath)) handoff.fail('receipt_path');
   if (process.env.GITHUB_OUTPUT) fs.appendFileSync(process.env.GITHUB_OUTPUT,
     `verified=true\nbuild-id=${proof.build_id}\nproducer-attempt=${proof.producer_attempt}\n` +

package/action/scripts/reconcile_apple_upload.cjs

@@ -3,6 +3,7 @@
 const fs = require('node:fs');
 const crypto = require('node:crypto');
 const github = require('./mobile_release_api.cjs');
+const provider = require('./apple_upload_proof.cjs');
 
 const RECEIPT = 'gowalk-cicd/apple-build-upload-receipt.v1';
 const OWNER = 'gowalk-cicd/mobile-upload-owner.v1';
@@ -20,6 +21,9 @@ function readReceipt(path) {
       !/^\d+(\.\d+){1,2}$/.test(data.cfBundleShortVersionString || '') ||
       !/^[a-f0-9]{64}$/.test(data.sha256 || '') || data.fileName !== `${data.sha256}.ipa` ||
       !Number.isSafeInteger(data.fileSize) || data.fileSize <= 0) refuse('receipt_invalid');
+  if (data.md5 !== undefined && (typeof data.md5 !== 'string' || !/^[a-f0-9]{32}$/.test(data.md5))) {
+    refuse('receipt_invalid');
+  }
   return data;
 }
 
@@ -69,26 +73,9 @@ async function appleGet(path, key = {pem: process.env.ASC_KEY_P8, id: process.en
 }
 
 async function verifyApple(receipt, get = appleGet) {
-  const upload = (await get(`/buildUploads/${receipt.upload_id}?include=build`)).data;
-  const attributes = upload?.attributes || {};
-  const buildId = upload?.relationships?.build?.data?.id;
-  if (upload?.id !== receipt.upload_id || attributes.state?.state !== 'COMPLETE' ||
-      attributes.cfBundleVersion !== receipt.cfBundleVersion ||
-      attributes.cfBundleShortVersionString !== receipt.cfBundleShortVersionString ||
-      !/^[A-Za-z0-9-]{1,64}$/.test(buildId || '')) refuse('upload_unverified');
-  const file = (await get(`/buildUploadFiles/${receipt.file_id}`)).data;
-  if (file?.id !== receipt.file_id || file.attributes?.assetType !== 'ASSET' ||
-      file.attributes.fileName !== receipt.fileName ||
-      file.attributes.fileSize !== receipt.fileSize ||
-      file.attributes.assetDeliveryState?.state !== 'COMPLETE') refuse('file_unverified');
-  const build = (await get(`/builds/${buildId}`)).data;
-  if (build?.id !== buildId || build.attributes?.processingState !== 'VALID' ||
-      build.attributes?.buildAudienceType !== 'APP_STORE_ELIGIBLE' ||
-      build.attributes?.version !== receipt.cfBundleVersion) refuse('build_unverified');
-  const app = (await get(`/builds/${buildId}/app`)).data;
-  if (app?.id !== receipt.app_id || app.attributes?.bundleId !== receipt.bundle_id) refuse('app_unverified');
-  return {build_id: buildId, app_id: app.id, version: receipt.cfBundleShortVersionString,
-    build: receipt.cfBundleVersion, upload_id: receipt.upload_id};
+  const proof = await provider.observe(receipt, get, refuse);
+  if (!proof) refuse('processing_pending');
+  return proof;
 }
 
 async function reconcile(deploymentId, runId, attempt, path, api = github, get = appleGet) {

package/action/scripts/upload_build.py

@@ -18,6 +18,7 @@ import requests
 import upload_checksums
 import upload_receipt
 import apple_upload_handoff
+import apple_upload_proof
 from upload_receipt import Receipt, UploadError
 
 # Provider refusals the uploader classifies itself instead of letting the shared
@@ -53,12 +54,16 @@ def identity(ipa: Path) -> dict:
             info = plistlib.loads(archive.read(names[0]))
     except (zipfile.BadZipFile, plistlib.InvalidFileException, KeyError) as exc:
         raise UploadError("ipa_invalid", "IPA is not a readable app archive") from exc
+    sha256, md5 = hashlib.sha256(), hashlib.md5()
     with ipa.open("rb") as stream:
-        digest = hashlib.file_digest(stream, "sha256").hexdigest()
+        for chunk in iter(lambda: stream.read(1024 * 1024), b""):
+            sha256.update(chunk)
+            md5.update(chunk)
+    digest = sha256.hexdigest()
     return {"bundle_id": str(info["CFBundleIdentifier"]),
             "cfBundleVersion": str(info["CFBundleVersion"]),
             "cfBundleShortVersionString": str(info["CFBundleShortVersionString"]),
-            "sha256": digest, "fileName": digest + ".ipa", "fileSize": ipa.stat().st_size}
+            "sha256": digest, "md5": md5.hexdigest(), "fileName": digest + ".ipa", "fileSize": ipa.stat().st_size}
 
 
 def upload_record(app_id: str, info: dict) -> dict:
@@ -176,17 +181,12 @@ def deliver(ipa: Path, report: Path, timeout: int, handoff: Path | None = None)
     processing_started = time.monotonic()
     deadline = processing_started + timeout
     while True:
-        current = api("GET", f"/buildUploads/{record['id']}", params={"include": "build"})["data"]
-        state = ((current.get("attributes") or {}).get("state") or {}).get("state")
-        build_id = (((current.get("relationships") or {}).get("build") or {}).get("data") or {}).get("id")
-        if state == "COMPLETE":
-            return receipt.update("complete", state=state, build_id=build_id,
+        proof, state = apple_upload_proof.observe(receipt.data, api)
+        if proof:
+            return receipt.update("complete", state="COMPLETE", upload_resource_state=state, **proof,
                                   processing_seconds=round(time.monotonic() - processing_started, 3))
-        receipt.update("processing", state=state, build_id=build_id,
+        receipt.update("processing", state=state,
                        processing_seconds=round(time.monotonic() - processing_started, 3))
-        if state == "FAILED":
-            raise UploadError("processing_failed",
-                              "Apple build upload failed processing; inspect the upload ID's provider errors")
         if time.monotonic() >= deadline:
             raise UploadError("processing_pending",
                               "Apple build processing is pending; reuse this upload ID on continuation")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.182",
+  "version": "1.0.184",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/remedies.json

@@ -2,8 +2,8 @@
   {
     "schema": "gowalk-cicd/apple-build-upload-failed.v2",
     "code": "processing_pending",
-    "fixed_in": "1.0.164",
-    "remedy": "Keep the original IPA and apple-build-upload receipt. If Apple later validates the exact upload, run reconcile_apple_upload.cjs in an authorized GitHub Actions recovery job with the original deployment, run, attempt and artifact receipt. It proves the failed owner, completed file, valid build and matching app before marking the deployment uploaded. Rerun the whole original deploy workflow after the readback; never upload a second binary or hand-edit the deployment receipt."
+    "fixed_in": "1.0.184",
+    "remedy": "Keep the original IPA and apple-build-upload receipt. From 1.0.184 recovery stages unchanged bytes as app.ipa so punctuation in the export filename cannot block retention. A PROCESSING upload summary can complete only after fresh proof of its completed matching asset/checksum and unique valid eligible iOS build, exact app/bundle and marketing version. Future receipts carry local MD5 as well as SHA-256. Run reconcile_apple_upload.cjs only in an authorized Actions recovery job with the original deployment, run, attempt and retained receipt; it never uploads. Read its owner completion back, then rerun the whole original deploy workflow. Missing original bytes or checksum proof remain unverified; never invent the digest, re-upload another binary under the same number or hand-edit the owner."
   },
   {
     "schema": "gowalk-cicd/mobile-release-refused.v1",
@@ -23,6 +23,12 @@
     "fixed_in": "1.0.132",
     "remedy": "Read the original run, attempt and deployment receipt before retrying. A completed uploaded receipt is reused with its original evidence; finish its metadata and submission work. An uploading receipt is ambiguous even when a later owner refusal reports no provider attempt. Adopt the 1.0.132 action and workflow together to place future Android intent writes inside acquired Play ownership. For an existing receipt, prove the exact provider build/version or use supported retained-binary recovery; never relabel it building by hand or clear ownership on elapsed time."
   },
+  {
+    "schema": "gowalk-cicd/mobile-release-refused.v1",
+    "code": "mobile_release_upload_unconfirmed_read_back_retained_binary_before_retry",
+    "fixed_in": "1.0.183",
+    "remedy": "Preserve the original upload owner and artifacts. If an iOS producer was cancelled after both Build and transfer iOS binary and Retain Apple verification handoff succeeded, use apple_upload_recovery.cjs RUN ATTEMPT DEPLOYMENT ARTIFACT from an authorized default-branch workflow_dispatch Actions job. It downloads and authenticates the original artifact, proves the terminal original and latest run, and reads fresh Apple upload/file/build/app evidence before reconciling that deployment. It never rebuilds, uploads or replays metadata. Retain its recovery proof, then rerun the whole original deployment workflow: admission reuses the uploaded receipt without another iOS binary. The old cancellation remains historical evidence; follow the new attempt to completion. Missing or mismatched evidence still refuses."
+  },
   {
     "schema": "gowalk-cicd/mobile-release-refused.v1",
     "code": "mobile_release_http_500",