gowalk-cicd 1.0.207 → 1.0.209

package/README.md

@@ -1390,10 +1390,12 @@ Identity failure logs and source Compose files do not establish this applied sta
 ### Read-only bridge and VPN prerequisite diagnostics
 
 Backend Deploy also offers `operation: network-diagnostics`, with an exact `diagnostic-service`, deployed
-`diagnostic-build-sha`, owned `diagnostic-network`, proposed namespace-only private IPv4 `/24` in
+`diagnostic-build-sha`, owned `diagnostic-network`, proposed namespace-only private IPv4 `/24` or IPv6 ULA `/64` in
 `diagnostic-pool`, exact `diagnostic-vpn-service`, and optional `diagnostic-provider: digitalocean`.
 It reports the owned bridge/IPAM, observed pool conflicts, UDP 500/4500 ownership, bound host identity and
-kernel/firewall facts in a closed v3 artifact. The allocator stays retired; a completed read is never
+kernel/firewall facts in a closed v3 artifact for IPv4 and v4 for IPv6. The IPv6 result also distinguishes
+host and owned-gateway default-route and forwarding observations; actual external connectivity stays unverified.
+The allocator stays retired; a completed read is never
 deployment, port reservation, globally unused address space or tunnel proof. Effective firewall ingress and
 unobserved capabilities remain unverified. The [trusted-host procedure](docs/BACKEND_SSH_GATE.md#owned-bridge-and-vpn-prerequisite-readback)
 defines scope, retained evidence and the required host runtime adoption before this operation is available.

package/action/action.yml

@@ -10,6 +10,10 @@ description: >
   consumers. App Store provisioning profiles are reconciled at runtime.
 
 inputs:
+  native-preparation-manifest:
+    description: Tracked manifest for app-owned native dependency preparation
+    required: false
+    default: ''
   candidate-binary:
     description: Verified candidate artifact directory supplied by the package workflow
     required: false
@@ -233,6 +237,16 @@ runs:
         sudo xcode-select -s "$XCODE_PATH"
         xcodebuild -version
 
+    - name: Prepare manifest-bound native dependencies
+      if: ${{ inputs.candidate-binary == '' && inputs.native-preparation-manifest != '' }}
+      shell: bash
+      env:
+        NATIVE_PREPARATION_MANIFEST: ${{ inputs.native-preparation-manifest }}
+      run: |
+        python3 "$SWIFT_APP_ACTION/scripts/native_preparation.py" prepare \
+          "$GITHUB_WORKSPACE" "$NATIVE_PREPARATION_MANIFEST" "$RUNNER_TEMP/native-preparation.json"
+        printf 'NATIVE_PREPARATION_MANIFEST=%s\n' "$NATIVE_PREPARATION_MANIFEST" >> "$GITHUB_ENV"
+
     - name: Describe native dependency cache
       if: ${{ inputs.candidate-binary == '' }}
       id: native_cache_scope

package/action/scripts/mobile_artifact_files.py

@@ -95,6 +95,12 @@ def pack(platform: str, directory: Path) -> None:
             raise ValueError("mobile_artifact_binary_ambiguous")
         (directory / "export").mkdir()
         shutil.copyfile(binaries[0], directory / "export" / "app.ipa")
+        manifest = os.environ.get("NATIVE_PREPARATION_MANIFEST", "")
+        if manifest:
+            import native_preparation
+            receipt = temp / "native-preparation.json"
+            native_preparation.verify(Path(os.environ["GITHUB_WORKSPACE"]).resolve(), manifest, receipt, outputs=True)
+            shutil.copyfile(receipt, directory / "native-preparation.json")
         symbols = ["firebase-symbols", "dart-symbols/ios"]
     else:
         binary = Path(os.environ["MOBILE_ARTIFACT_BINARY"])
@@ -120,6 +126,14 @@ def verify(platform: str, directory: Path) -> dict:
             or value.get("credential_fingerprints") != credentials(platform)
             or value.get("files") != files(directory)):
         raise ValueError("mobile_artifact_inputs_mismatch")
+    if platform == "ios":
+        manifest = os.environ.get("NATIVE_PREPARATION_MANIFEST", "")
+        if manifest:
+            import native_preparation
+            native_preparation.verify(Path(os.environ["GITHUB_WORKSPACE"]).resolve(), manifest,
+                                      directory / "native-preparation.json")
+        elif "native-preparation.json" in value["files"]:
+            raise ValueError("mobile_artifact_inputs_mismatch")
     expected = set(IOS_ENV if platform == "ios" else ANDROID_ENV)
     environment = value.get("environment", {})
     if set(environment) not in (expected, expected - {SOURCE_PLIST}) or any(

package/action/scripts/native_preparation.py

@@ -0,0 +1,166 @@
+#!/usr/bin/env python3
+"""Prepare and attest tracked, app-authored native build dependencies."""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path, PurePosixPath
+import re
+import subprocess
+import sys
+
+SCHEMA = 'gowalk-cicd/native-preparation.v1'
+RECEIPT = 'gowalk-cicd/native-preparation-receipt.v1'
+MAX_FILES = 10000
+
+
+def digest(path):
+    with path.open('rb') as stream:
+        return hashlib.file_digest(stream, 'sha256').hexdigest()
+
+
+def command(*args, cwd):
+    return subprocess.run(args, cwd=cwd, check=True, stdout=subprocess.PIPE,
+                          stderr=subprocess.DEVNULL, text=True).stdout
+
+
+def path_at(root, name):
+    if not isinstance(name, str) or len(name) > 500 or not re.fullmatch(r'[A-Za-z0-9_./-]+', name):
+        raise ValueError('native_preparation_path_invalid')
+    path = PurePosixPath(name)
+    if path.is_absolute() or any(part in ('', '.', '..') for part in name.split('/')):
+        raise ValueError('native_preparation_path_invalid')
+    if 'creds' in path.parts or '.git' in path.parts or any(part.startswith('.env') for part in path.parts):
+        raise ValueError('native_preparation_path_invalid')
+    result = root.joinpath(*path.parts)
+    current = root
+    for part in path.parts:
+        current = current / part
+        if current.is_symlink():
+            raise ValueError('native_preparation_symlink')
+    return result
+
+
+def tracked(root, name):
+    path = path_at(root, name)
+    if not path.is_file():
+        raise ValueError('native_preparation_input_absent')
+    command('git', 'ls-files', '--error-unmatch', '--', name, cwd=root)
+    command('git', 'diff', '--quiet', 'HEAD', '--', name, cwd=root)
+    return digest(path)
+
+
+def load(root, name):
+    manifest_hash = tracked(root, name)
+    path = path_at(root, name)
+    if path.stat().st_size > 65536:
+        raise ValueError('native_preparation_manifest_invalid')
+    data = json.loads(path.read_text())
+    if (not isinstance(data, dict) or set(data) != {'schema', 'script', 'inputs', 'outputs'}
+            or data['schema'] != SCHEMA or not isinstance(data['inputs'], list)
+            or not isinstance(data['outputs'], list) or not data['outputs']
+            or len(data['inputs']) > 100 or len(data['outputs']) > 100):
+        raise ValueError('native_preparation_manifest_invalid')
+    inputs = [name, data['script'], *data['inputs']]
+    if len(set(inputs)) != len(inputs) or len(set(data['outputs'])) != len(data['outputs']):
+        raise ValueError('native_preparation_manifest_invalid')
+    hashes = {item: tracked(root, item) for item in inputs}
+    if hashes[name] != manifest_hash or not os.access(path_at(root, data['script']), os.X_OK):
+        raise ValueError('native_preparation_script_invalid')
+    for output in data['outputs']:
+        path_at(root, output)
+        if command('git', 'ls-files', '-z', '--', output, cwd=root):
+            raise ValueError('native_preparation_output_tracked')
+        command('git', 'check-ignore', '-q', '--', output, cwd=root)
+    return data, hashes
+
+
+def output_tree(root, name):
+    path = path_at(root, name)
+    if not path.exists():
+        raise ValueError('native_preparation_output_absent')
+    paths = [path] if path.is_file() else sorted(path.rglob('*'))
+    entries = []
+    for item in paths:
+        if item.is_symlink():
+            raise ValueError('native_preparation_symlink')
+        if item.is_file():
+            entries.append([item.relative_to(root).as_posix(), digest(item)])
+            if len(entries) > MAX_FILES:
+                raise ValueError('native_preparation_output_limit')
+        elif not item.is_dir():
+            raise ValueError('native_preparation_output_invalid')
+    if not entries:
+        raise ValueError('native_preparation_output_absent')
+    return {'path': name, 'files': len(entries), 'sha256': hashlib.sha256(
+        json.dumps(entries, ensure_ascii=True, separators=(',', ':')).encode()).hexdigest()}
+
+
+def identity(root, name):
+    data, inputs = load(root, name)
+    return data, {'schema': RECEIPT, 'manifest': name, 'inputs': inputs}
+
+
+def prepare(root, manifest, receipt):
+    data, result = identity(root, manifest)
+    command('git', 'diff', '--quiet', 'HEAD', '--', cwd=root)
+    allowed = ('PATH', 'HOME', 'TMPDIR', 'RUNNER_TEMP', 'APP_ROBOT_TASK_SCRATCH', 'DEVELOPER_DIR', 'SDKROOT',
+               'CI', 'GITHUB_ACTIONS', 'GITHUB_RUN_ID', 'GITHUB_RUN_ATTEMPT', 'GITHUB_JOB')
+    environment = {key: os.environ[key] for key in allowed if key in os.environ}
+    if environment.get('GITHUB_ACTIONS') == 'true':
+        environment['CI'] = 'true'
+    environment['GITHUB_WORKSPACE'] = str(root)
+    subprocess.run([str(path_at(root, data['script']))], cwd=root, env=environment, check=True)
+    command('git', 'diff', '--quiet', 'HEAD', '--', cwd=root)
+    _, after = identity(root, manifest)
+    if result != after:
+        raise ValueError('native_preparation_input_changed')
+    result['toolchain'] = command('xcodebuild', '-version', cwd=root).strip()
+    result['outputs'] = [output_tree(root, name) for name in data['outputs']]
+    receipt.write_text(json.dumps(result, sort_keys=True, indent=2) + '\n')
+
+
+def verify(root, manifest, receipt, *, outputs=False):
+    data, expected = identity(root, manifest)
+    if receipt.is_symlink() or not receipt.is_file() or receipt.stat().st_size > 1024 * 1024:
+        raise ValueError('native_preparation_receipt_invalid')
+    actual = json.loads(receipt.read_text())
+    if (not isinstance(actual, dict) or set(actual) != set(expected) | {'toolchain', 'outputs'}
+            or any(actual.get(k) != v for k, v in expected.items())
+            or not isinstance(actual.get('toolchain'), str) or not actual['toolchain']
+            or not isinstance(actual.get('outputs'), list) or len(actual['outputs']) != len(data['outputs'])):
+        raise ValueError('native_preparation_receipt_invalid')
+    for expected_path, item in zip(data['outputs'], actual['outputs']):
+        if (not isinstance(item, dict) or set(item) != {'path', 'files', 'sha256'}
+                or item['path'] != expected_path or type(item['files']) is not int
+                or not 0 < item['files'] <= MAX_FILES or not isinstance(item['sha256'], str)
+                or len(item['sha256']) != 64 or any(c not in '0123456789abcdef' for c in item['sha256'])):
+            raise ValueError('native_preparation_receipt_invalid')
+    if outputs and (actual['outputs'] != [output_tree(root, name) for name in data['outputs']]
+                    or actual['toolchain'] != command('xcodebuild', '-version', cwd=root).strip()):
+        raise ValueError('native_preparation_output_changed')
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('operation', choices=['prepare', 'verify', 'verify-outputs'])
+    parser.add_argument('root', type=Path)
+    parser.add_argument('manifest')
+    parser.add_argument('receipt', type=Path)
+    args = parser.parse_args()
+    try:
+        root = args.root.resolve(strict=True)
+        if args.operation == 'prepare':
+            prepare(root, args.manifest, args.receipt)
+        else:
+            verify(root, args.manifest, args.receipt, outputs=args.operation == 'verify-outputs')
+    except (ValueError, OSError, subprocess.SubprocessError, TypeError, KeyError) as error:
+        code = str(error) if isinstance(error, ValueError) and str(error).startswith('native_preparation_') else \
+            'native_preparation_failed'
+        print(code, file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())

package/backend-action/action.yml

@@ -27,7 +27,7 @@ inputs:
     required: false
     default: default
   diagnostic-pool:
-    description: Proposed strict private IPv4 /24 for a VPN container namespace; never a host allocation.
+    description: Proposed strict private IPv4 /24 or IPv6 ULA /64 for a VPN namespace; never a host allocation.
     required: false
     default: ""
   diagnostic-vpn-service:

package/backend-action/network_host.py

@@ -105,6 +105,75 @@ def local_docker():
         raise NetworkFailure('network_scope_mismatch')
 
 
+def _ipv6_default(raw):
+    if raw is None:
+        return 'unverified'
+    try:
+        rows = json.loads(raw)
+        if not isinstance(rows, list) or any(not isinstance(row, dict) for row in rows):
+            raise ValueError()
+        found = False
+        for row in rows:
+            if row.get('dst', 'default') not in ('default', '::/0'):
+                raise ValueError()
+            flags = row.get('flags', [])
+            if not isinstance(flags, list) or any(not isinstance(flag, str) for flag in flags):
+                raise ValueError()
+            kind = row.get('type', 'unicast')
+            if kind not in ('unicast', 'blackhole', 'unreachable', 'prohibit', 'throw'):
+                raise ValueError()
+            device = row.get('dev')
+            if kind == 'unicast' and (not isinstance(device, str) or not re.fullmatch(r'[A-Za-z0-9_.-]{1,15}', device)):
+                raise ValueError()
+            found |= kind == 'unicast' and device != 'lo' and 'linkdown' not in flags
+        return 'present' if found else 'absent'
+    except (ValueError, TypeError, UnicodeError):
+        return 'unverified'
+
+
+def ipv6_routes(containers, app, service, bridge, namespace_safe=False):
+    host = _ipv6_default(run(['ip', '-j', '-6', 'route', 'show', 'default'], optional=True))
+    host_forward = run(['cat', '/proc/sys/net/ipv6/conf/all/forwarding'], optional=True)
+    forwarding = (None if host_forward is None or host_forward.strip() not in (b'0', b'1')
+                  else host_forward.strip() == b'1')
+    matches = [row for row in containers if row['service'] == service and row['running']]
+    if len(matches) > 1:
+        raise NetworkFailure('network_ambiguous')
+    if not matches:
+        gateway = 'not_running'
+        gateway_forwarding = None
+    elif not namespace_safe:
+        gateway, gateway_forwarding = 'unverified', None
+    else:
+        template = ('{"project":{{json (index .Config.Labels "com.docker.compose.project")}},'
+                    '"service":{{json (index .Config.Labels "com.docker.compose.service")}},'
+                    '"mode":{{json .HostConfig.NetworkMode}},"key":{{json .NetworkSettings.SandboxKey}}}')
+        raw = run(['docker', 'inspect', '--format', template, matches[0]['id']], optional=True)
+        try:
+            record = json.loads(raw) if raw else {}
+            if not isinstance(record, dict):
+                raise ValueError()
+            if record and (record.get('project') != app or record.get('service') != service
+                           or record.get('mode') != bridge['name']):
+                raise NetworkFailure('network_changed')
+            path = record.get('key', '')
+        except (ValueError, UnicodeError):
+            path = ''
+        if not isinstance(path, str):
+            path = ''
+        if not re.fullmatch(r'/var/run/docker/netns/[0-9a-f]{12,64}', path):
+            gateway, gateway_forwarding = 'unverified', None
+        else:
+            entry = ['nsenter', '--net=' + path, '--']
+            raw = run([*entry, 'ip', '-j', '-6', 'route', 'show', 'default'], optional=True)
+            gateway = _ipv6_default(raw)
+            raw = run([*entry, 'cat', '/proc/sys/net/ipv6/conf/all/forwarding'], optional=True)
+            gateway_forwarding = None if raw is None or raw.strip() not in (b'0', b'1') else raw.strip() == b'1'
+    return {'host_ipv6_default_route': host, 'gateway_ipv6_default_route': gateway,
+            'host_ipv6_forwarding': forwarding, 'gateway_ipv6_forwarding': gateway_forwarding,
+            'ipv6_external_connectivity': 'unverified'}
+
+
 def namespace(containers, app, vpn_service, bridge):
     info = run(['docker', 'info', '--format', '{"os":{{json .OSType}},"security":{{json .SecurityOptions}}}'])
     try:

package/backend-action/network_inventory.py

@@ -79,9 +79,11 @@ def selected(rows, app, key):
             'ipam': [{'subnet': x['Subnet'], 'gateway': x.get('Gateway', '')} for x in row['ipam']]}
 
 
-def host_networks():
+def host_networks(include_ipv6=False):
     addresses = decode(run(['ip', '-j', 'address', 'show']))
     routes = decode(run(['ip', '-j', '-4', 'route', 'show', 'table', 'all']))
+    if include_ipv6:
+        routes += decode(run(['ip', '-j', '-6', 'route', 'show', 'table', 'all']))
     result = []
     try:
         for row in addresses:
@@ -102,7 +104,7 @@ def host_networks():
 
 
 def overlap(rows, bridge, host_rows, pool):
-    proposed = ipaddress.IPv4Network(pool)
+    proposed = ipaddress.ip_network(pool, strict=True)
     own = [ipaddress.ip_network(item['subnet']) for item in bridge['ipam']]
     foreign = [ipaddress.ip_network(item['Subnet']) for row in rows if row['id'] != bridge['network_id']
                for item in row['ipam'] or []]

package/backend-action/network_projection.py

@@ -5,6 +5,7 @@ import re
 from runtime_projection import READER_VERSION, PROJECT, SERVICE, SHA, CID
 
 SCHEMA = 'gowalk-cicd/backend-network-diagnostics.v3'
+IPV6_SCHEMA = 'gowalk-cicd/backend-network-diagnostics.v4'
 FAILURES = frozenset({'invalid_scope', 'network_absent', 'network_ambiguous', 'network_scope_mismatch',
     'network_changed', 'network_invalid', 'build_mismatch', 'host_binding_mismatch', 'command_timeout',
     'output_limit', 'command_failed', 'transport_failure', 'remote_invalid', 'artifact_write_failed',
@@ -23,18 +24,22 @@ def scope(app, service, expected, network, pool, vpn_service, host, provider):
     if any(not isinstance(value, str) or not re.fullmatch(pattern, value) for value, pattern in fields):
         raise NetworkFailure('invalid_scope')
     try:
-        candidate = ipaddress.IPv4Network(pool, strict=True)
+        candidate = ipaddress.ip_network(pool, strict=True)
     except (ValueError, TypeError):
         raise NetworkFailure('invalid_scope') from None
     private = ('10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16')
-    if (candidate.prefixlen != 24 or not any(candidate.subnet_of(ipaddress.IPv4Network(x)) for x in private)
-            or provider not in ('none', 'digitalocean')):
+    v4 = (candidate.version == 4 and candidate.prefixlen == 24
+          and any(candidate.subnet_of(ipaddress.IPv4Network(x)) for x in private))
+    v6 = (candidate.version == 6 and candidate.prefixlen == 64
+          and candidate.subnet_of(ipaddress.IPv6Network('fc00::/7')))
+    if not (v4 or v6) or provider not in ('none', 'digitalocean'):
         raise NetworkFailure('invalid_scope')
 
 
 def envelope(app, service, expected, network, pool, vpn_service, host, provider, failure='', *,
              reader_version=READER_VERSION):
-    return {'schema': SCHEMA, 'reader_version': reader_version, 'ok': not failure, 'failure': failure,
+    schema = IPV6_SCHEMA if isinstance(pool, str) and ':' in pool else SCHEMA
+    return {'schema': schema, 'reader_version': reader_version, 'ok': not failure, 'failure': failure,
             'project': app, 'build_service': service, 'expected_build_sha': expected, 'network_key': network,
             'proposed_pool': pool, 'vpn_service': vpn_service, 'expected_host': host, 'provider': provider}
 
@@ -65,7 +70,7 @@ def bridge_record(row, app, network):
             raise NetworkFailure('remote_invalid') from None
 
 
-def observation_records(result):
+def observation_records(result, ipv6=False):
     closed(result['overlap'], ('selected_bridge_foreign_docker', 'selected_bridge_host',
         'pool_selected_bridge', 'pool_foreign_docker', 'pool_host_routes', 'pool_host_addresses',
         'default_gateway_destinations'))
@@ -83,8 +88,12 @@ def observation_records(result):
         if ((row['status'] == 'free') == observed
                 or row['status'] in ('app_vpn', 'foreign') and not row['docker_binding_observed']):
             raise NetworkFailure('remote_invalid')
-    closed(result['namespace'], ('docker_linux_rootful', 'host_ipv4_forwarding', 'xfrm_read',
-        'netfilter_nat_read', 'selected_bridge_masquerade', 'vpn_settings'))
+    fields = {'docker_linux_rootful', 'host_ipv4_forwarding', 'xfrm_read',
+              'netfilter_nat_read', 'selected_bridge_masquerade', 'vpn_settings'}
+    if ipv6:
+        fields |= {'host_ipv6_default_route', 'gateway_ipv6_default_route', 'host_ipv6_forwarding',
+                   'gateway_ipv6_forwarding', 'ipv6_external_connectivity'}
+    closed(result['namespace'], fields)
     for key in ('docker_linux_rootful', 'host_ipv4_forwarding', 'selected_bridge_masquerade'):
         if result['namespace'][key] is not None and type(result['namespace'][key]) is not bool:
             raise NetworkFailure('remote_invalid')
@@ -93,6 +102,14 @@ def observation_records(result):
             raise NetworkFailure('remote_invalid')
     if result['namespace']['vpn_settings'] not in ('absent', 'isolated_net_admin', 'other', 'unverified'):
         raise NetworkFailure('remote_invalid')
+    if ipv6:
+        row = result['namespace']
+        if (row['host_ipv6_default_route'] not in ('present', 'absent', 'unverified')
+                or row['gateway_ipv6_default_route'] not in ('present', 'absent', 'not_running', 'unverified')
+                or any(row[key] is not None and type(row[key]) is not bool
+                       for key in ('host_ipv6_forwarding', 'gateway_ipv6_forwarding'))
+                or row['ipv6_external_connectivity'] != 'unverified'):
+            raise NetworkFailure('remote_invalid')
 
 
 def host_records(result, provider):
@@ -146,6 +163,6 @@ def validate(result, app, service, expected, network, pool, vpn_service, host, p
             or not re.fullmatch(r'\d{4}-\d\d-\d\dT\d\d:\d\d:\d\dZ', result['observed_at'])):
         raise NetworkFailure('remote_invalid')
     bridge_record(result['bridge'], app, network)
-    observation_records(result)
+    observation_records(result, ipv6=':' in pool)
     host_records(result, provider)
     return result

package/backend-action/network_readback.py

@@ -26,23 +26,31 @@ def application(app, service, expected):
     return rows
 
 
-def snapshot(app, service, expected):
+def snapshot(app, service, expected, ipv6=False):
     return {'application': application(app, service, expected), 'networks': network_inventory.networks(),
-            'host': network_inventory.host_networks(), 'bindings': network_inventory.port_bindings(),
+            'host': network_inventory.host_networks(include_ipv6=ipv6), 'bindings': network_inventory.port_bindings(),
             'listeners': network_host.listeners()}
 
 
 def collect(app, service, expected, network, pool, vpn_service, host, provider):
     scope(app, service, expected, network, pool, vpn_service, host, provider)
     network_host.local_docker()
-    original = snapshot(app, service, expected)
+    ipv6 = ':' in pool
+    original = snapshot(app, service, expected, ipv6=ipv6)
     bridge = network_inventory.selected(original['networks'], app, network)
     host_result = network_metadata.observe(host, original['host'], provider)
     firewall, masquerade, netfilter = network_host.firewall(bridge)
     namespace = network_host.namespace(original['application'], app, vpn_service, bridge)
     namespace.update(netfilter_nat_read=netfilter, selected_bridge_masquerade=masquerade)
-    if snapshot(app, service, expected) != original:
+    safe = namespace['vpn_settings'] == 'isolated_net_admin'
+    routes = network_host.ipv6_routes(original['application'], app, vpn_service, bridge,
+                                      namespace_safe=safe) if ipv6 else None
+    if (snapshot(app, service, expected, ipv6=ipv6) != original
+            or ipv6 and network_host.ipv6_routes(original['application'], app, vpn_service, bridge,
+                                                  namespace_safe=safe) != routes):
         raise NetworkFailure('network_changed')
+    if routes is not None:
+        namespace.update(routes)
     result = dict(envelope(app, service, expected, network, pool, vpn_service, host, provider),
         observed_build_sha=expected, bridge=bridge, host=host_result, firewall=firewall, namespace=namespace,
         overlap=network_inventory.overlap(original['networks'], bridge, original['host'], pool),

package/docs/BACKEND_SSH_GATE.md

@@ -107,7 +107,7 @@ shared-database substitution.
 `operation: network-diagnostics` is a read-only operation. The network allocator remains retired.
 Select `diagnostic-service` (the existing API), `diagnostic-network` (the existing Compose bridge key,
 default `default`), `diagnostic-vpn-service` (default `vpn`), `expected-build-sha`, and `diagnostic-pool`:
-a strict RFC1918 IPv4 `/24` proposed only for the VPN container namespace. It creates no address reservation,
+a strict RFC1918 IPv4 `/24` or IPv6 ULA `/64` proposed only for the VPN container namespace. It creates no reservation,
 network, route, firewall rule, container, certificate or service. Do not use this pool as Compose IPAM.
 The generated workflow transports `diagnostic-build-sha` separately so a workflow-only commit can inspect
 the API build actually deployed, rather than claiming its own checkout SHA is running.
@@ -123,7 +123,7 @@ released `network_readback.py`. It accepts no uploaded Python or app-mirror help
 alone cannot install this host operation: install the integrity-verified published runtime first. A missing
 host reader returns `network_reader_unavailable` with no host reader version; it is not a network verdict.
 
-The closed `gowalk-cicd/backend-network-diagnostics.v3` result is retained as
+The closed `gowalk-cicd/backend-network-diagnostics.v3` IPv4 result, or `v4` for IPv6, is retained as
 `backend-network-diagnostics-<job>-<attempt>/result.json`. `ok: true` means the bounded read completed;
 it never means a VPN is provisioned, traffic is reachable, a pool is globally unused or a tunnel works.
 The reader binds the existing API's `BUILD_SHA`, checks its exact project/service/directory labels, and
@@ -150,12 +150,17 @@ for client compatibility, so prove adoption with the install receipt and the for
   only NET_ADMIN plus optional NET_BIND_SERVICE/CHOWN/SETUID/SETGID/SETPCAP for bootstrap and privilege dropping,
   and namespace-only forwarding/redirect settings. This observes grants, not that a daemon actually dropped privileges.
   An absent VPN reports `absent`; these observations do not test creating a namespace or applying capabilities.
+- An IPv6 request additionally compares the proposed ULA against host IPv6 routes, addresses and Docker subnets.
+  It reports host and owned-gateway IPv6 default-route and forwarding observations independently; missing tools or
+  inaccessible namespaces remain `unverified`, and an absent gateway reports `not_running`. A default route is not
+  a usable Internet path: `ipv6_external_connectivity` stays `unverified` until an independent traffic exercise.
 - `firewall` reports observed INPUT/FORWARD policies and explicit UDP ACCEPT rules. Effective ingress
   remains `unverified`: chained rules, nftables and upstream/provider firewalls need actual external traffic proof.
 
 Foreign network ownership/configuration, process identities, raw firewall rules, environment values and
 private bindings never leave the host. Foreign subnet data is used privately only to calculate overlap flags.
-The reader executes no container code, reads no logs and contacts no provider management API.
+The IPv6 reader enters only the verified owned container's Docker network namespace using host `ip` and `cat`; it
+executes no container code, reads no logs and contacts no provider management API.
 No retry, downgrade, unrestricted SSH or historical inventory can replace a refused current read.
 Preserve bridge and database identities, assess the observations within their stated scope, then separately
 verify the actual namespaced gateway configuration, IKEv2 negotiation and encrypted forwarded traffic.

package/docs/CANDIDATE_ARTIFACTS.md

@@ -70,3 +70,45 @@ and pinned cache programs as release builds. Cache Pods and `.factory/toolchain/
 helper's lockfile/Ruby/Xcode/architecture identity; `pod install --deployment` and committed locks
 remain required. Beyond that conditional dependency priming, no compile warm-up, machine affinity, reservation
 or factory wait protocol is added.
+
+## App-owned native preparation
+
+A native iOS app whose Xcode graph consumes generated, lockfile-pinned local frameworks may set
+`mobile.ios.native-preparation-manifest` in `.gowalk-cicd.yml` to a tracked JSON file:
+
+```json
+{
+  "schema": "gowalk-cicd/native-preparation.v1",
+  "script": "tools/ios/prepare-libraries.sh",
+  "inputs": ["tools/ios/library.lock.json"],
+  "outputs": [".factory/cache/library/ios/Example.xcframework"]
+}
+```
+
+All names are repository-relative. The manifest, executable script and declared inputs must be
+regular tracked files matching the frozen checkout. The tracked tree must remain unchanged through
+preparation. Output trees must be gitignored, contain no tracked files and cannot contain symlinks.
+The script itself must pin and verify its downloaded inputs, must not run tests, and must
+produce all declared outputs with the active Xcode toolchain. The helper executes it as an argument,
+not as an interpolated shell command. App-authored source and this build recipe are subject to the
+same review and trusted-candidate policy as Xcode build phases.
+The child receives a narrow environment, including the nonsecret GitHub run, attempt and job
+identity so a recipe can distinguish a fresh build from same-job cache reuse; credentials and
+unrelated workflow variables are not forwarded.
+
+The action runs preparation after selecting Xcode and before Xcode project detection on an actual
+macOS build. It records the source and output hashes and Xcode version, then checks those outputs
+again before packing a candidate. The preparation receipt travels as an authenticated candidate
+artifact file. Promotion verifies its manifest and source hashes along with the binary's existing
+source, credential and artifact checks, and does not rebuild or require generated frameworks on
+Linux. Missing, stale or malformed evidence fails closed. The full tracked mobile source, including
+all scripts, lockfiles and configuration, remains part of the candidate fingerprint; the manifest
+is not a substitute for reviewing a dependency recipe or testing the produced software.
+
+Custom validation workflows that need the same graph can invoke the shipped helper before their
+native dependency guard:
+
+```sh
+python3 .github/actions/swift-app/scripts/native_preparation.py prepare \
+  "$GITHUB_WORKSPACE" tools/ios/native-deps.json "$RUNNER_TEMP/native-preparation.json"
+```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.207",
+  "version": "1.0.209",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/config/schema.mjs

@@ -44,6 +44,11 @@ function validateNamedSettings(config) {
   if (candidate !== undefined && typeof candidate !== 'boolean') {
     throw new MigrationRepair('candidate_setting_requires_boolean', '.gowalk-cicd.yml');
   }
+  const manifest = config.mobile?.ios?.['native-preparation-manifest'];
+  if (manifest !== undefined && (typeof manifest !== 'string' || !/^[A-Za-z0-9_.\/-]+$/.test(manifest) ||
+      manifest.startsWith('/') || manifest.split('/').some(part => !part || part === '.' || part === '..'))) {
+    throw new MigrationRepair('native_preparation_manifest_path_invalid', '.gowalk-cicd.yml');
+  }
   for (const platform of ['ios', 'android']) {
     const value = config.mobile?.[platform];
     const allowed = fields.filter(path => path[1] === platform).map(path => path[2]);

package/src/config/settings.mjs

@@ -6,7 +6,8 @@ const ios = ['jobs', 'ios', 'steps', 'items', 'id:ios', 'with'];
 const android = ['jobs', 'android', 'steps', 'items', 'id:android', 'with'];
 const backend = ['jobs', 'deploy', 'steps', 'items', 'name:Deploy backend', 'with'];
 const inputs = {
-  ios: ['project', 'workspace', 'scheme', 'configuration', 'bundle-id', 'team-id', 'firebase-app-id'],
+  ios: ['project', 'workspace', 'scheme', 'configuration', 'bundle-id', 'team-id', 'firebase-app-id',
+    'native-preparation-manifest'],
   android: ['project-dir', 'module', 'variant', 'firebase-app-id', 'dart-defines'],
   backend: ['ssh-key', 'host', 'app-name', 'api-domain', 'backend-dir', 'compose-file', 'health-path', 'runtime-env',
     'public-health-url', 'public-base-url', 'expected-build-sha', 'ingress-required', 'ingress-token'],
@@ -16,6 +17,8 @@ export function settingsPaths(file) {
   if (file === 'deploy.yml') return [
     { name: ['mobile', 'platforms'], path: mobile },
     ...inputs.ios.map(key => ({ name: ['mobile', 'ios', key], path: [...ios, key] })),
+    { name: ['mobile', 'ios', 'native-preparation-manifest'],
+      path: ['jobs', 'ios', 'env', 'NATIVE_PREPARATION_MANIFEST'] },
     ...inputs.android.map(key => ({ name: ['mobile', 'android', key], path: [...android, key] })),
   ];
   if (file === 'deploy-backend.yml') return inputs.backend.map(key => ({

package/templates/deploy-backend.yml

@@ -37,7 +37,7 @@ on:
         required: false
       diagnostic-pool:
         type: string
-        description: Proposed namespace-only VPN private IPv4 /24
+        description: Proposed namespace-only VPN private IPv4 /24 or IPv6 ULA /64
         required: false
       diagnostic-network:
         type: string