gowalk-cicd 1.0.90 → 1.0.92

package/CLAUDE.md

@@ -156,11 +156,13 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   consumer autoupdate changes the action directory. The installer delivers this development
   tooling for native iOS repositories too; it does not require an Android app.
 - Flutter manifest/archive GET recovery is scoped to the two pinned setup invocations through `BASH_ENV`.
-  It retains the account proxy and allows four attempts within 60 seconds for manifests or 30 minutes
+  It retains the account proxy and allows four attempts within 60 seconds for manifests or 20 minutes
   for archives, with an 8 GiB archive bound. Interrupted archives resume private bytes with HTTP Range; an origin ignoring
   Range permits a bounded full restart. Only complete JSON or an archive matching the selected official
   manifest's SHA-256 enters action outputs. Authentication/certificate refusals remain terminal.
   `flutter_download_failed` emits fixed transport codes and retained-byte counts, never curl stderr.
+  Archive progress emits retained byte counts every minute and safe results after each attempt;
+  the transfer deadline leaves room for a failure receipt before a 30-minute validation job ends.
 - Web Release selects bundled renderer resources with `--no-web-resources-cdn` inside
   the existing proxied build command. This is not a font or integration offline guarantee;
   preserve app-authored font declarations, bootstrap configuration and other build inputs.
@@ -280,7 +282,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   symbols and uploads them before the store bundle, using the configured proxy.
 - Play readiness and AAB/APK version inventory share one prebuild edit. Retry OAuth
   transport, inventory reads and cleanup of that known edit; never replay an ambiguous
-  `edits.insert`. Only an explicit package-404 allows first-release defaults; failed
+  `edits.insert`. Edit creation retries at most three times only for typed connection-timeout
+  or typed connection failure / CONNECT 502,503,504 evidence that no provider request was sent. Bare proxy errors,
+  TLS verification failures, provider responses and lost origin responses do not authorize a retry.
+  Only an explicit package-404 allows first-release defaults; failed
   inventory is not an empty account. The action exposes `play-api-ready` so current
   workflows skip the redundant postbuild check. Error annotations carry safe
   phase/category evidence and any cleanup edit ID without raw provider exceptions.

package/README.md

@@ -299,6 +299,13 @@ the situation and whose **message** is one line of JSON carrying a versioned
 | `apple_build_upload_failed` (error) | `gowalk-cicd/apple-build-upload-failed.v2` | `category`, `stage`, `receipt_available`, receipt identifiers (`cfBundleVersion`, `upload_id`, `file_id`, `state`, `provider_status`, `provider_code`, `provider_pointer`), `action` |
 | `flutter_download_failed` (error) | `gowalk-cicd/flutter-download-failed.v1` | `phase`, `curl_exit`, `http_status`, `proxy_status`, `attempts`, `retained_bytes` |
 
+SDK transfers also emit `flutter_download_progress` notices with schema
+`gowalk-cicd/flutter-download-progress.v1`. Each carries `phase`, `event`, `elapsed_ms`
+and `retained_bytes`; `attempt_finished` adds `attempt`, `curl_exit`, `http_status`
+and `proxy_status`. In-progress notices arrive each minute; elapsed time belongs to
+the current attempt. Archives have a 20-minute total transfer budget so a failure
+receipt precedes a 30-minute validation job's deadline. Progress is not a success receipt.
+
 Add a field by bumping the schema version; never change the meaning of an
 existing one.
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.90
+1.0.92

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.90
+1.0.92

package/android-action/scripts/flutter_download.py

@@ -7,8 +7,10 @@ import re
 import shutil
 import subprocess
 import sys
+import time
 
 MAX_ARCHIVE_BYTES = 8 * 1024 * 1024 * 1024
+PROGRESS_SECONDS = 60
 
 
 def archive_digest() -> str:
@@ -20,19 +22,45 @@ def archive_digest() -> str:
 
 def transfer(url: str, destination: Path, kind: str, remaining: float, env: dict) -> tuple[int, int, int]:
     resume = kind == "archive" and destination.stat().st_size > 0
+    budget = min(20 if kind == "manifest" else 600, remaining)
     command = ["curl", "--disable", "--silent", "--show-error", "--fail", "--retry", "0",
-               "--connect-timeout", "15", "--max-time", str(min(20 if kind == "manifest" else 600, remaining)),
+               "--connect-timeout", "15", "--max-time", str(budget),
                "--max-filesize", str(16777216 if kind == "manifest" else MAX_ARCHIVE_BYTES),
                "--output", str(destination), "--write-out", "%{http_code} %{http_connect}"]
     if resume:
         command += ["--continue-at", "-"]
-    try:
-        result = subprocess.run([*command, url], capture_output=True, timeout=remaining, env=env)
-        status = result.stdout.split()
-        http, proxy = (map(int, status) if len(status) == 2 and all(part.isdigit() for part in status) else (0, 0))
-        return result.returncode, http, proxy
-    except subprocess.TimeoutExpired:
-        return 28, 0, 0
+    with subprocess.Popen([*command, url], stdout=subprocess.PIPE, stderr=subprocess.PIPE, env=env) as process:
+        try:
+            return wait_transfer(process, destination, kind, budget)
+        finally:
+            if process.poll() is None:
+                process.kill()
+                process.communicate()
+
+
+def wait_transfer(process, destination: Path, kind: str, budget: float) -> tuple[int, int, int]:
+    started = time.monotonic()
+    while True:
+        left = budget - (time.monotonic() - started)
+        if left <= 0:
+            return 28, 0, 0
+        try:
+            output, _private_error = process.communicate(timeout=min(PROGRESS_SECONDS, left))
+            status = output.split()
+            http, proxy = (map(int, status) if len(status) == 2
+                           and all(part.isdigit() for part in status) else (0, 0))
+            return process.returncode, http, proxy
+        except subprocess.TimeoutExpired:
+            if kind == "archive":
+                progress(destination, started, "transferring")
+
+
+def progress(destination: Path, started: float, event: str, **fields) -> None:
+    note = {"schema": "gowalk-cicd/flutter-download-progress.v1", "phase": "archive", "event": event,
+            "elapsed_ms": round((time.monotonic() - started) * 1000),
+            "retained_bytes": destination.stat().st_size, **fields}
+    print("::notice title=flutter_download_progress::" + json.dumps(note, separators=(",", ":")),
+          file=sys.stderr, flush=True)
 
 
 def publish(destination: Path, kind: str) -> None:

package/android-action/scripts/flutter_manifest.py

@@ -22,7 +22,7 @@ def download(arguments: list[str], directory: Path) -> int:
     if kind == "archive":
         flutter_download.archive_digest()
     child_env = {**os.environ, "NO_PROXY": "", "no_proxy": ""}
-    deadline, code, http, proxy_http = time.monotonic() + (60 if kind == "manifest" else 1800), 1, 0, 0
+    deadline, code, http, proxy_http = time.monotonic() + (60 if kind == "manifest" else 1200), 1, 0, 0
     destination = directory / "download"
     destination.touch(mode=0o600, exist_ok=False)
     destination.chmod(0o600)
@@ -32,7 +32,11 @@ def download(arguments: list[str], directory: Path) -> int:
         if remaining <= 0:
             break
         attempted = attempt
+        started = time.monotonic()
         code, http, proxy_http = flutter_download.transfer(arguments[-1], destination, kind, remaining, child_env)
+        if kind == "archive":
+            flutter_download.progress(destination, started, "attempt_finished", attempt=attempt,
+                                      curl_exit=code, http_status=http, proxy_status=proxy_http)
         if code == 0 and http in ({200, 206} if kind == "archive" else {200}):
             flutter_download.publish(destination, kind)
             if attempt > 1:

package/android-action/scripts/play_preflight.py

@@ -55,9 +55,9 @@ def opened_edit(client, package: str, account: Path):
     call("oauth_refresh", lambda: credentials.refresh(request), retry=True)
     headers = {"Authorization": f"Bearer {credentials.token}"}
     url = f"{BASE_URL}/applications/{package}/edits"
-    # A timed-out insert may already have created an edit. Never blindly insert again.
+    # Retry only a proven failed connection; an ambiguous insert is never replayed.
     response = call("edit_create", lambda: client.post(url, headers=headers, json={}, timeout=30),
-                    accepted=(200, 404))
+                    accepted=(200, 404), retry_connect=True)
     if response.status_code == 404:
         print(
             "::warning::Google Play package is not API-ready. The app session must upload the "

package/android-action/scripts/play_preflight_transport.py

@@ -2,15 +2,45 @@
 from __future__ import annotations
 
 import json
+import re
 import time
 
 from google.auth.exceptions import RefreshError, TransportError
 import requests
+from urllib3 import exceptions as urllib_errors
 
 RETRY_STATUSES = {429, 500, 502, 503, 504}
 TRANSPORT_ERRORS = (requests.RequestException, TransportError)
 
 
+def connection_not_sent(error: Exception) -> bool:
+    """Retry only typed connection failure or a transient HTTP CONNECT refusal.
+
+    Requests explicitly declares ConnectTimeout safe to retry. Other failures must
+    carry urllib3's structured reason. ProxyError alone is ambiguous: it can wrap
+    a dropped origin response. A plain OSError with http.client's exact tunnel
+    status framing identifies CONNECT 502/503/504 before any origin TLS/POST.
+    """
+    if isinstance(error, requests.exceptions.ConnectTimeout):
+        return error.response is None
+    if not isinstance(error, requests.exceptions.ConnectionError) or error.response is not None:
+        return False
+    if len(error.args) != 1:
+        return False
+    reason = error.args[0]
+    if isinstance(reason, urllib_errors.MaxRetryError):
+        reason = reason.reason
+    if isinstance(reason, urllib_errors.ConnectTimeoutError):
+        return True
+    if not isinstance(reason, urllib_errors.ProxyError):
+        return False
+    original = reason.original_error
+    if isinstance(original, urllib_errors.ConnectTimeoutError):
+        return True
+    return (type(original) is OSError and original.errno is None
+            and re.fullmatch(r"Tunnel connection failed: (?:502|503|504)(?: [^\r\n]*)?", str(original)) is not None)
+
+
 def transport_code(error: Exception) -> str:
     pending, seen = [error], set()
     while pending and len(seen) < 12:
@@ -45,13 +75,13 @@ def fail(phase: str, code: str, attempt: int, *, status: int | None = None,
 
 
 def call(phase: str, operation, *, retry: bool = False, edit_id: str | None = None,
-         accepted: tuple[int, ...] | None = None):
-    limit = 3 if retry else 1
+         accepted: tuple[int, ...] | None = None, retry_connect: bool = False):
+    limit = 3 if retry or retry_connect else 1
     for attempt in range(1, limit + 1):
         try:
             result = operation()
         except TRANSPORT_ERRORS as error:
-            if attempt == limit:
+            if attempt == limit or (not retry and not connection_not_sent(error)):
                 fail(phase, transport_code(error), attempt, edit_id=edit_id)
         except RefreshError:
             fail(phase, "oauth_refresh_failed", attempt)

package/android-action/scripts/play_proxy_test_support.py

@@ -0,0 +1,82 @@
+"""An owned TLS origin inside a loopback CONNECT proxy; no external traffic."""
+from contextlib import contextmanager
+from datetime import datetime, timedelta, timezone
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+import ssl
+import tempfile
+import threading
+
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.x509.oid import NameOID
+
+
+def tls_material(root):
+    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "play.test")])
+    now = datetime.now(timezone.utc)
+    cert = (x509.CertificateBuilder().subject_name(name).issuer_name(name).public_key(key.public_key())
+            .serial_number(x509.random_serial_number()).not_valid_before(now - timedelta(days=1))
+            .not_valid_after(now + timedelta(days=1))
+            .add_extension(x509.SubjectAlternativeName([x509.DNSName("play.test")]), critical=False)
+            .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
+            .sign(key, hashes.SHA256()))
+    path = Path(root)
+    certificate, private = path / "certificate.pem", path / "private.pem"
+    certificate.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
+    private.write_bytes(key.private_bytes(serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8,
+                                        serialization.NoEncryption()))
+    private.chmod(0o600)
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    context.load_cert_chain(certificate, private)
+    return context, str(certificate)
+
+
+class Proxy(BaseHTTPRequestHandler):
+    def do_CONNECT(self):
+        self.server.connections.append(self.path)
+        self.server.authenticated.append(bool(self.headers.get("Proxy-Authorization")))
+        if len(self.server.connections) <= self.server.reject:
+            self.send_error(502, "private proxy rejection")
+            return
+        self.send_response(200)
+        self.end_headers()
+        try:
+            with self.server.context.wrap_socket(self.connection, server_side=True) as stream:
+                stream.settimeout(3)
+                request = b""
+                while b"\r\n\r\n" not in request:
+                    data = stream.recv(4096)
+                    if not data:
+                        return
+                    request += data
+                self.server.requests.append(request.split(b"\r\n", 1)[0])
+                if self.server.drop_response:
+                    return
+                body = b'{"id":"edit-1"}'
+                response = b"HTTP/1.1 200 OK\r\nConnection: close\r\nContent-Length: " + str(len(body)).encode()
+                stream.sendall(response + b"\r\nContent-Type: application/json\r\n\r\n" + body)
+        except ssl.SSLError:
+            pass
+
+    def log_message(self, *args):
+        pass
+
+
+@contextmanager
+def running(*, reject=0, drop_response=False):
+    with tempfile.TemporaryDirectory(prefix="play-connect-test-") as root:
+        server = ThreadingHTTPServer(("127.0.0.1", 0), Proxy)
+        server.context, certificate = tls_material(root)
+        server.connections, server.requests, server.authenticated = [], [], []
+        server.reject, server.drop_response = reject, drop_response
+        thread = threading.Thread(target=server.serve_forever, daemon=True)
+        thread.start()
+        try:
+            yield server, certificate
+        finally:
+            server.shutdown()
+            server.server_close()
+            thread.join(timeout=2)

package/android-action/scripts/test_flutter_download_budget.py

@@ -0,0 +1,42 @@
+"""Archive failure remains observable before the consumer's 30-minute validation job expires."""
+import contextlib
+import io
+import json
+import os
+from pathlib import Path
+import tempfile
+import unittest
+from unittest.mock import patch
+
+import flutter_manifest
+
+
+class DownloadBudgetTests(unittest.TestCase):
+    def test_failed_archive_reports_before_the_outer_job_cancels_it(self):
+        elapsed = [0.0]
+
+        def transfer(_url, destination, _kind, remaining, _env):
+            elapsed[0] += min(600, remaining)
+            with destination.open("ab") as output:
+                output.write(b"partial")
+            return 28, 200, 200
+
+        with tempfile.TemporaryDirectory() as directory, contextlib.redirect_stderr(io.StringIO()) as error:
+            with patch.dict(os.environ, HTTPS_PROXY="http://fixture-user:fixture-secret@localhost:1",
+                            GOWALK_FLUTTER_ARCHIVE_SHA256="a" * 64):
+                with patch.object(flutter_manifest.time, "monotonic", side_effect=lambda: elapsed[0]), \
+                        patch.object(flutter_manifest.time, "sleep", side_effect=lambda seconds: None), \
+                        patch.object(flutter_manifest.flutter_download, "transfer", side_effect=transfer):
+                    result = flutter_manifest.download(["--connect-timeout", "15", "--retry", "5",
+                        "https://fixture.invalid/flutter_infra_release/releases/stable/linux/sdk.tar.xz"],
+                        Path(directory))
+        self.assertEqual(result, 28)
+        self.assertLess(elapsed[0], 1800 - 60, "A failure receipt must precede the enclosing job deadline")
+        receipt = next(line.split("::", 2)[2] for line in error.getvalue().splitlines()
+                       if line.startswith("::error title=flutter_download_failed::"))
+        self.assertGreater(json.loads(receipt)["retained_bytes"], 0)
+        self.assertNotIn("fixture-secret", error.getvalue())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_flutter_transfer_progress.py

@@ -0,0 +1,81 @@
+"""Private child transfers expose byte progress and terminate within their own deadline."""
+import contextlib
+import io
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+from unittest.mock import patch
+
+import flutter_download
+
+
+class TransferProgressTests(unittest.TestCase):
+    def invoke(self, script, remaining):
+        children = []
+        popen = subprocess.Popen
+        with tempfile.TemporaryDirectory() as directory, contextlib.redirect_stderr(io.StringIO()) as error:
+            destination = Path(directory) / "archive"
+            destination.touch()
+
+            def child(_command, **kwargs):
+                process = popen([sys.executable, "-c", script, str(destination)], **kwargs)
+                children.append(process)
+                return process
+
+            with patch.object(flutter_download.subprocess, "Popen", side_effect=child), \
+                    patch.object(flutter_download, "PROGRESS_SECONDS", .03):
+                result = flutter_download.transfer("https://fixture.invalid/sdk.tar.xz", destination,
+                                                   "archive", remaining, dict(os.environ))
+            data = destination.read_bytes()
+        self.assertTrue(all(process.poll() is not None for process in children))
+        self.assertNotIn("fixture-secret", error.getvalue())
+        notices = [json.loads(line.split("::", 2)[2]) for line in error.getvalue().splitlines()]
+        self.assertTrue(notices)
+        self.assertTrue(any(note["retained_bytes"] > 0 for note in notices))
+        self.assertTrue(all(note["event"] == "transferring" for note in notices))
+        return result, data
+
+    def test_progress_does_not_publish_private_child_stderr_or_partial_archive(self):
+        script = ("import pathlib,sys,time; p=pathlib.Path(sys.argv[1]); p.write_bytes(b'partial'); "
+                  "sys.stderr.write('fixture-secret'); time.sleep(.2); p.write_bytes(b'complete'); "
+                  "print('206 200',end='')")
+        result, data = self.invoke(script, 2)
+        self.assertEqual((result, data), ((0, 206, 200), b"complete"))
+
+    def test_deadline_kills_only_the_owned_transfer_and_preserves_resume_bytes(self):
+        script = ("import pathlib,sys,time; pathlib.Path(sys.argv[1]).write_bytes(b'partial'); "
+                  "sys.stderr.write('fixture-secret'); time.sleep(5)")
+        started = time.monotonic()
+        result, data = self.invoke(script, .2)
+        self.assertLess(time.monotonic() - started, 2)
+        self.assertEqual((result, data), ((28, 0, 0), b"partial"))
+
+    def test_progress_failure_does_not_leave_the_owned_child_running(self):
+        popen, children = subprocess.Popen, []
+
+        def child(_command, **kwargs):
+            process = popen([sys.executable, "-c", "import time; time.sleep(5)"], **kwargs)
+            children.append(process)
+            return process
+
+        started = time.monotonic()
+        with tempfile.TemporaryDirectory() as directory:
+            destination = Path(directory) / "archive"
+            destination.touch()
+            with patch.object(flutter_download.subprocess, "Popen", side_effect=child), \
+                    patch.object(flutter_download, "PROGRESS_SECONDS", .03), \
+                    patch.object(flutter_download, "progress", side_effect=OSError("closed output")):
+                with self.assertRaises(OSError):
+                    flutter_download.transfer("https://fixture.invalid/sdk.tar.xz", destination,
+                                              "archive", 2, dict(os.environ))
+        self.assertLess(time.monotonic() - started, 2)
+        self.assertTrue(all(process.poll() is not None for process in children))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_play_connect_retry.py

@@ -0,0 +1,115 @@
+"""Edit inserts retry only transport evidence that excludes an origin request."""
+import io
+from pathlib import Path
+import ssl
+import sys
+import unittest
+from unittest import mock
+
+import requests
+from urllib3 import exceptions as errors
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import play_preflight_transport as transport
+
+
+def proxy_failure(cause=None):
+    cause = cause or OSError("Tunnel connection failed: 502 private proxy refusal")
+    reason = errors.ProxyError("private proxy", cause)
+    return requests.exceptions.ProxyError(errors.MaxRetryError(None, "private URL", reason))
+
+
+class ConnectRetryTests(unittest.TestCase):
+    def setUp(self):
+        self.sleep = self.enterContext(mock.patch.object(transport.time, "sleep"))
+        self.output = self.enterContext(mock.patch("sys.stdout", new_callable=io.StringIO))
+
+    def test_proven_connection_failures_recover_with_one_successful_insert(self):
+        connection = errors.NewConnectionError(None, "private connect failure")
+        direct = requests.exceptions.ConnectionError(errors.MaxRetryError(None, "private URL", connection))
+        for error in (requests.exceptions.ConnectTimeout("private"), proxy_failure(),
+                      proxy_failure(connection), direct):
+            with self.subTest(kind=type(error).__name__):
+                response = mock.Mock(status_code=200)
+                operation = mock.Mock(side_effect=[error, response])
+                self.assertIs(transport.call("edit_create", operation, retry_connect=True, accepted=(200,)), response)
+                self.assertEqual(operation.call_count, 2)
+                self.assertNotIn("private", self.output.getvalue())
+
+    def test_ambiguous_errors_never_authorize_an_insert_retry(self):
+        for error in (requests.exceptions.ReadTimeout("private"), requests.exceptions.ProxyError("private"),
+                      requests.exceptions.ConnectionError(errors.ProtocolError("private")),
+                      proxy_failure(OSError("unknown private refusal")),
+                      proxy_failure(OSError("Tunnel connection failed: 407 private authentication")),
+                      proxy_failure(errors.ProtocolError("Tunnel connection failed: 502 private"))):
+            with self.subTest(kind=type(error).__name__):
+                operation = mock.Mock(side_effect=error)
+                with self.assertRaises(SystemExit):
+                    transport.call("edit_create", operation, retry_connect=True)
+                operation.assert_called_once()
+        self.sleep.assert_not_called()
+
+    def test_proxy_wrapped_tls_failure_remains_terminal(self):
+        error = proxy_failure(errors.SSLError(ssl.SSLCertVerificationError("private certificate")))
+        operation = mock.Mock(side_effect=error)
+        with self.assertRaises(SystemExit):
+            transport.call("edit_create", operation, retry_connect=True)
+        operation.assert_called_once()
+        self.sleep.assert_not_called()
+        self.assertNotIn("private", self.output.getvalue())
+
+    def test_origin_response_never_uses_connection_retry_permission(self):
+        operation = mock.Mock(return_value=mock.Mock(status_code=503))
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("edit_create", operation, retry_connect=True, accepted=(200, 404))
+        operation.assert_called_once()
+        self.sleep.assert_not_called()
+        self.assertIn('"status": 503', str(caught.exception))
+
+    def test_lost_response_after_a_connection_retry_stops_at_that_attempt(self):
+        operation = mock.Mock(side_effect=[proxy_failure(), requests.exceptions.ReadTimeout("private")])
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("edit_create", operation, retry_connect=True)
+        self.assertEqual(operation.call_count, 2)
+        self.assertIn('"attempts": 2', str(caught.exception))
+        self.sleep.assert_called_once_with(1)
+
+    def test_failed_connections_are_bounded_and_keep_safe_evidence(self):
+        operation = mock.Mock(side_effect=proxy_failure())
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("edit_create", operation, retry_connect=True)
+        self.assertEqual(operation.call_count, 3)
+        self.assertEqual(self.sleep.call_args_list, [mock.call(1), mock.call(2)])
+        self.assertIn('"attempts": 3', str(caught.exception))
+        self.assertIn('"code": "proxy_connection_failed"', str(caught.exception))
+        self.assertNotIn("private", str(caught.exception) + self.output.getvalue())
+
+    def test_other_writes_have_no_implicit_retry_permission(self):
+        operation = mock.Mock(side_effect=proxy_failure())
+        with self.assertRaises(SystemExit):
+            transport.call("another_write", operation)
+        operation.assert_called_once()
+        self.sleep.assert_not_called()
+
+
+class PreflightConnectWiringTests(unittest.TestCase):
+    def test_real_preflight_recovers_connection_before_one_known_edit_cleanup(self):
+        import play_preflight as preflight
+
+        client = mock.Mock()
+        client.post.side_effect = [proxy_failure(), mock.Mock(status_code=200, text='{"id":"known-edit"}')]
+        client.delete.return_value = mock.Mock(status_code=204)
+        credentials = mock.Mock(token="private token")
+        with mock.patch.object(preflight.service_account.Credentials, "from_service_account_file",
+                               return_value=credentials), mock.patch.object(preflight, "write_ready") as ready, \
+                mock.patch.object(transport.time, "sleep"), mock.patch("sys.stdout", new_callable=io.StringIO):
+            preflight.check_ready(client, "com.example.app", Path("account.json"))
+        self.assertEqual(client.post.call_count, 2)
+        self.assertEqual(client.post.call_args_list[0], client.post.call_args_list[1])
+        client.delete.assert_called_once()
+        self.assertTrue(client.delete.call_args.args[0].endswith("/known-edit"))
+        ready.assert_called_once_with(True)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_play_connect_runtime.py

@@ -0,0 +1,62 @@
+"""Real Requests traffic proves bounded proxy retry and no replay after an origin POST."""
+from contextlib import redirect_stdout
+import io
+import os
+from pathlib import Path
+import sys
+import unittest
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import play_preflight_transport as transport
+import play_store_proxy
+from play_proxy_test_support import running
+
+
+class ConnectRuntimeTests(unittest.TestCase):
+    def test_two_failed_tunnels_then_one_origin_post_on_the_same_assigned_proxy(self):
+        with running(reject=2) as (server, certificate):
+            env = {"GOOGLE_STORE_PROXY_URL": f"http://user:private-password@127.0.0.1:{server.server_port}",
+                   "HTTPS_PROXY": "http://127.0.0.1:1", "NO_PROXY": "*"}
+            output = io.StringIO()
+            with mock.patch.dict(os.environ, env), play_store_proxy.session() as client, \
+                    mock.patch.object(transport.time, "sleep"), redirect_stdout(output):
+                client.verify = certificate
+                result = transport.call("edit_create", lambda: client.post("https://play.test/edits", timeout=3),
+                                        retry_connect=True, accepted=(200,))
+            self.assertEqual(result.json(), {"id": "edit-1"})
+            self.assertEqual(server.connections, ["play.test:443"] * 3)
+            self.assertEqual(server.requests, [b"POST /edits HTTP/1.1"])
+            self.assertEqual(server.authenticated, [True] * 3)
+            self.assertNotIn("private", output.getvalue())
+
+    def test_dropped_response_after_received_post_is_never_replayed(self):
+        with running(drop_response=True) as (server, certificate):
+            env = {"GOOGLE_STORE_PROXY_URL": f"http://127.0.0.1:{server.server_port}"}
+            output = io.StringIO()
+            with mock.patch.dict(os.environ, env), play_store_proxy.session() as client, \
+                    mock.patch.object(transport.time, "sleep") as sleep, redirect_stdout(output):
+                client.verify = certificate
+                with self.assertRaises(SystemExit) as caught:
+                    transport.call("edit_create", lambda: client.post("https://play.test/edits", timeout=3),
+                                   retry_connect=True, accepted=(200,))
+            self.assertEqual(server.connections, ["play.test:443"])
+            self.assertEqual(server.requests, [b"POST /edits HTTP/1.1"])
+            self.assertIn('"attempts": 1', str(caught.exception))
+            sleep.assert_not_called()
+
+    def test_untrusted_tls_certificate_stops_before_origin_post_without_retry(self):
+        with running() as (server, _certificate):
+            env = {"GOOGLE_STORE_PROXY_URL": f"http://127.0.0.1:{server.server_port}"}
+            with mock.patch.dict(os.environ, env), play_store_proxy.session() as client, \
+                    mock.patch.object(transport.time, "sleep") as sleep, redirect_stdout(io.StringIO()):
+                with self.assertRaises(SystemExit):
+                    transport.call("edit_create", lambda: client.post("https://play.test/edits", timeout=3),
+                                   retry_connect=True, accepted=(200,))
+            self.assertEqual(server.connections, ["play.test:443"])
+            self.assertEqual(server.requests, [])
+            sleep.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.90
+1.0.92

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.90",
+  "version": "1.0.92",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {