Skip to main content

Mobile Release Evidence QA Checklist

Prerequisites​

  • Local QA report summary is current and linked from the completed manual run ledger.
  • Local mobile build/test lanes pass where host supports them, or each skipped local lane has a finding and reason.
  • Release evidence manifests are present.

Manual Local Checks​

  • Android debug build artifact exists and checksum is recorded.
  • Android release lane config references expected targets and placeholders only where allowed.
  • Peak POS iOS and Peak Mobile iOS project/build metadata checks pass.
  • Store screenshot manifests exist and reference current flows.
  • Privacy/data-safety evidence files exist and are current.
  • Firebase/TestFlight/Play distribution placeholders are clearly labeled when local-only.
  • Missing artifact, checksum mismatch, unavailable metadata, and blocked local lane failure states are recorded with owner/status.
  • Empty screenshot manifest and populated screenshot manifest fixtures both produce clear evidence outcomes.

Manual Staging/Release Checks​

  • Android signing material comes from approved secret path, not source.
  • Play Console internal testing upload succeeds.
  • Play Integrity and FCM staging behavior verified.
  • Permission denial, revoked signing credential, unauthorized console user, and unavailable upload/API failure paths are recorded.
  • iOS archive/export/upload succeeds.
  • TestFlight install and APNs/DeviceCheck behavior verified.
  • Store listing screenshots and privacy answers reviewed.

Peak Mobile Release Artifact Evidence Manifest​

Anchor ID: flow:peak-mobile-workflows

Local automated proof:

  • bazel test //apps/mobile:mobile_release_artifact_evidence_test
  • bazel test //apps/mobile:mobile_release_artifact_manifest_test
  • bazel test //apps/mobile:mobile_store_screenshot_manifest_test
  • bazel test //apps/mobile:mobile_store_metadata_test
  • bazel test //apps/mobile:mobile_secrets_signing_evidence_test
  • bazel test //apps/mobile:mobile_android_release_lane_helpers_test
  • bazel test //apps/mobile:mobile_ios_release_lane_helpers_test
  • bazel test //apps/mobile:peak_mobile_lane_test

Local manual audit:

  • Prerequisites: run the release-evidence proof bundle after any mobile release workflow, signing/secret handling, Firebase identity, store metadata, screenshot manifest, or release artifact manifest change.
  • Steps: confirm release-artifacts.md, store-submission.md, secrets-signing.md, app-readiness.yaml, store-assets.yaml, and store-metadata.yaml all remain PENDING for real uploads while local gates prove manifest completeness, artifact byte/hash verification, screenshot provenance, support/privacy metadata, signing cleanup, and secret-name-only classification.
  • Expected evidence: passing Bazel targets, Android and iOS release manifest validators that re-read artifact bytes, store screenshot manifest validator that re-reads screenshot bytes and checks UTC capture timestamps, store metadata validation for package/bundle IDs and support/privacy URLs, and secrets/signing validation that names required secret handles without storing secret values.
  • Pass/fail criteria: pass only when local proof distinguishes artifact readiness from authenticated staging/store upload proof, keeps all real release rows PENDING until CI/store-console evidence exists, and rejects missing/tampered manifests, wrong app identity, placeholder Firebase config, unsafe signing fallback, or leaked credential values.

Staging/release manual audit:

  • Prerequisites: release workflow run IDs, production signing material in the approved secret stores, Firebase/App Store/Play credentials, artifact manifests, screenshot manifests, and store-console draft links.
  • Steps: attach Android/iOS release artifact manifests, store screenshot manifest, Firebase App Distribution/TestFlight/Play internal upload IDs, store draft links, App Check/Crashlytics evidence, and redacted signing cleanup logs to the release evidence packet.
  • Expected evidence: Git SHA, version, app IDs, artifact names, manifest rows, byte sizes, SHA-256 checksums, screenshot manifest rows, store metadata review status, upload IDs, console links, and explicit store-review hold reasons where uploads are intentionally paused.
  • Pass/fail criteria: pass only when every Peak Mobile artifact, screenshot, credential, and store-metadata claim is tied to the same release build and no keystore, provisioning profile, App Store Connect key, Firebase payload, service-account JSON, bearer token, or App Check token appears in evidence.

Peak POS iOS Release Evidence Manifest​

Anchor ID: flow:ios-pos-workflows

Local automated proof:

  • bazel test //apps/mobile:mobile_smoke_evidence_templates_test
  • bazel test //apps/mobile:mobile_release_artifact_evidence_test
  • bazel test //apps/mobile:mobile_ios_release_lane_helpers_test
  • bazel test //apps/ios:peak_pos_client_lane_test

Local manual audit:

  • Prerequisites: apps/mobile/production-readiness/evidence/peak-pos-ios-smoke.md remains PENDING for real release readiness but records simulator/device runtime, app build identity, SDK artifact/version, release asset name, release artifact manifest row, and staging credential status.
  • Steps: confirm the Peak POS iOS smoke manifest names the local unsigned simulator/Bazel validator proof boundary separately from authenticated staging or TestFlight workflow proof.
  • Expected evidence: local proof names the installed app identity co.peakpos.pos, the simulator/device runtime, PeakPosSdk.xcframework artifact source, SDK contract version, release asset placeholder, and credentials_missing or another observable skip taxonomy until staging credentials are attached.
  • Pass/fail criteria: pass only when local build proof cannot be mistaken for TestFlight/staging workflow proof and the manifest rejects missing SDK, runtime, app build, release asset, or credential-status fields.

Staging/release manual audit:

  • Prerequisites: TestFlight or signed release-candidate artifact for co.peakpos.pos, ios-release-artifacts-${version}.jsonl, SDK artifact checksum, Firebase/App Check credentials, org/store/register IDs, terminal mTLS material where used, and approved Gateway/Nexgo evidence.
  • Steps: install the same artifact named in the release manifest, run checkout, catalog/product sync, receipt, offline retry, push notification, and payment handoff smoke paths, then attach simulator/device runtime, screenshots or video, backend request IDs, transaction/sync IDs, SDK artifact version, and credential status to the evidence packet.
  • Expected evidence: every PASS row ties the route/workflow, installed artifact, SDK artifact version/checksum, simulator/device runtime, staging backend request IDs, and credential source classification to the same release version.
  • Pass/fail criteria: pass only when authenticated staging evidence is tied to the signed/TestFlight artifact and no Firebase/App Check, App Store Connect, provisioning, bearer-token, mTLS, Gateway, or device credential value appears in the evidence.

Gateway SDK Credential Redaction​

  • Local: run the SDK credential-redaction bundle and confirm retry attempts re-evaluate auth/App Check providers without leaking stale headers.
  • Local: verify rendered SDK evidence redacts Authorization and X-Firebase-AppCheck values while preserving attempt count and retry context.
  • Local: verify private Gateway Maven Android/core KMP 401 or 403 failures are classified as credential/preflight blockers with scripts/gateway-maven-credentials.sh remediation, not as terminal-api behavior failures.
  • Staging/release: capture credentialed SDK/mobile build output and confirm raw Gateway Maven credentials, bearer tokens, App Check tokens, mTLS cert/key material, and device credentials are absent from logs, screenshots, and QA reports.

Peak POS SDK Gateway Maven Credential Classification​

Anchor ID: flow:sdk-contracts-builds

Local automated proof:

  • bazel test //libs/sdks/kotlin/peak-pos-sdk:sdk_retry_credential_contract_test
  • bazel test //scripts/qa:verify_preflight_test
  • bazel test //scripts/qa:aggregate_reports_test
  • ./scripts/local-validation/qa.sh test preflight

Local manual audit:

  • Prerequisites: do not print or paste COURSIER_CREDENTIALS, GATEWAY_MAVEN_KEY, GATEWAY_MAVEN_ACCESS_TOKEN, .netrc passwords, or Google access tokens while checking this lane.
  • Steps: run the focused SDK/preflight classifier bundle, then inspect the current preflight report. If Gateway Maven access is unavailable, confirm the report says Gateway Maven credentials are unavailable or unauthorized, names gateway-sdk-android and gateway-sdk-core-kmp, preserves 401/403 detail, and recommends source scripts/gateway-maven-credentials.sh.
  • Expected evidence: SDK retry credential contract proves fresh auth/App Check providers and redacted evidence; preflight unit tests prove missing .netrc and 401/403 Artifact Registry failures classify as credential setup; the aggregate report test preserves that classification in strict evidence; the live preflight report contains no raw token or password material.
  • Pass/fail criteria: pass when private Gateway Maven failures are classified as credential/preflight blockers rather than SDK contract regressions, the remediation command is visible, and all rendered evidence is redaction-safe.

Staging/release manual audit:

  • Prerequisites: credentialed CI or staging build environment with approved Artifact Registry access, or a documented credential-gated skip.
  • Steps: run the SDK/mobile build that fetches com.myriad.gateway:gateway-sdk-android and com.myriad.gateway:gateway-sdk-core-kmp; if it fails, capture only redacted status and artifact coordinates, not token contents.
  • Expected evidence: pass shows both private artifacts reachable; failure shows credential blocker class, HTTP status, Artifact Registry host, artifact IDs, remediation command, and no secret material.
  • Pass/fail criteria: pass only when build evidence cleanly separates private dependency credential state from SDK source/API regressions.

Peak POS SDK KMP/XCFramework Artifact Build​

Anchor ID: flow:sdk-contracts-builds

Local automated proof:

  • bazel build //libs/sdks/kotlin/peak-pos-sdk:peak_pos_sdk_kmp_xcframework_zip
  • bazel build //libs/sdks/kotlin/peak-pos-sdk:peak_pos_sdk_kmp_spm_checksum
  • bazel test //libs/sdks:kmp_xcframework_artifact_contract_test
  • bazel test //scripts/qa:xcframework_host_availability_test
  • bazel test //apps/mobile:peak_mobile_lane_test
  • bazel test //apps/ios:peak_pos_client_lane_test

Local manual audit:

  • Prerequisites: run this lane on a macOS host with Xcode when claiming real XCFramework artifact PASS evidence; WSL/Linux may run the metadata contract proof but must not be treated as artifact-production proof.
  • Steps: build the XCFramework zip and SPM checksum, then record host platform, Xcode availability, PeakPosSdk version 0.1.0, the produced peak_pos_sdk_kmp-xcframework.zip path, SHA-256, SPM checksum, and the Android/iOS/Peak Mobile consumer lane validator outputs.
  • Expected evidence: peak_kmp_module declares assemblePeakPosSdkXCFramework, the KMP helper fails if no .xcframework output exists, both Swift packages reference the stable zip path or staged copy, release smoke evidence requires SDK version/checksum/Gateway SDK version, and a macOS/Xcode run produces the actual archive.
  • Pass/fail criteria: pass only when the artifact zip and checksum are produced on a Mac/Xcode-capable runner and consumer lanes record the SDK artifact boundary. If Gradle succeeds but no .xcframework is produced, record blocker_class=local_lab_missing with host_platform=macos_required; do not classify it as a Gateway Maven credential failure unless the failure is a private Artifact Registry 401/403.
  • Current tracker note: ./scripts/local-validation/qa.sh test external-gates and .dev-logs/qa/reports/external-gates-20260607T083639Z.md include this host gate in the aggregate external-blocker summary. .dev-logs/qa/reports/xcframework-host-availability-20260607T083639Z.md was produced by the host availability probe and records this workstation as a Linux host with no xcodebuild, no Swift CLI, and no current XCFramework output. This is blocker evidence only; it does not replace the required Mac/Xcode artifact zip and SPM checksum proof.

Staging/release manual audit:

  • Prerequisites: signed or release-candidate iOS/Peak Mobile artifact, ios-release-artifacts-${version}.jsonl, produced peak_pos_sdk_kmp-xcframework.zip, SPM checksum, Gateway SDK version, and consumer app build output.
  • Steps: attach the XCFramework zip SHA-256, SPM checksum, SDK version, Gateway SDK version, artifact manifest row, Swift package consumer path, and app lane validation commands to the release evidence packet.
  • Expected evidence: every release PASS row ties the same SDK archive, checksum, version, Gateway SDK version, iOS POS app artifact, and Peak Mobile app artifact together.
  • Pass/fail criteria: pass only when release evidence proves the exact SDK archive consumed by iOS POS and Peak Mobile, without leaking App Store, Firebase, Gateway Maven, mTLS, or signing credentials.

Generated SDK Contract Drift​

Anchor ID: flow:sdk-contracts-builds

Local automated proof:

  • bazel test //libs/sdks:generated_sdk_contract_drift_test
  • bazel test //scripts:check_sdk_drift_test
  • bazel test //scripts:check_openapi_contract_test
  • bazel test //tools/openapi-generator:merchant_sdk_contract_test
  • bazel test //apps/mobile:peak_mobile_lane_test
  • bazel test //apps/ios:peak_pos_client_lane_test

Local manual audit:

  • Prerequisites: run this bundle after OpenAPI artifacts, generated SDK packages, tools/openapi-generator/generate.py, MODULE.bazel Gateway SDK coordinates, or mobile/iOS lane validators change.
  • Steps: confirm generated API/model/client files carry the OpenAPI generator marker and regenerate command; confirm each generated Kotlin/TypeScript SDK package maps to a checked-in artifacts/openapi/*.openapi.json; confirm the Peak POS KMP generated merchant/terminal roots map to merchant-api and terminal-api OpenAPI artifacts; and confirm Peak Mobile plus iOS POS lane validators pin the single GATEWAY_SDK_VERSION from MODULE.bazel.
  • Expected evidence: generated SDK provenance headers, OpenAPI artifact names, generator entry points, SDK drift extraction unit proof, merchant generated SDK endpoint coverage, and consumer validator version-pin proof.
  • Pass/fail criteria: pass only when generated source drift is represented by generator/OpenAPI/SDK contract checks instead of per-file manual QA rows, and the failing evidence can identify whether the source of drift is the OpenAPI artifact, generator target, SDK package, or consumer version pin.

Staging/release manual audit:

  • Prerequisites: release branch with generated SDK artifacts and the app/mobile consumer lanes that depend on them.
  • Steps: attach the generated SDK contract bundle result, generator command, relevant OpenAPI artifact checksums, SDK package version or artifact name, and app-lane validator output to the release evidence packet.
  • Expected evidence: clear mapping from generated package to source OpenAPI artifact and release app lane, plus no expanded per-generated-file manual QA denominator.
  • Pass/fail criteria: pass only when generated SDK drift is caught before release and consumer validator failures point back to the version or contract that drifted.

Expected Evidence​

  • Local QA report path and strict evidence summary path.
  • Artifact paths and checksums.
  • Console upload IDs.
  • Screenshot manifest and any rejected/missing evidence.
  • Privacy/data-safety review note and credential-gated skip notes.