Distribute prebuilt mobile FFI binaries (Releases) + a warden_ffi_flutter plugin — consume Veil without a Rust toolchain

[nandal]

Problem

After the monorepo split, the Dart binding (warden_ffi) is published to pub.dev, but the native libraries it binds to are not distributed anywhere. ffi/build-mobile.sh builds them, and the outputs are git-ignored (correctly — we don't commit binaries). So today every machine that wants to build a consuming Flutter app for a device must check out warden and cross-compile the binary itself, which requires a full Rust + iOS/Android cross toolchain (Xcode targets, NDK, cargo-ndk).

The binary is platform-specific but not machine-specific — an xcframework/.so built once works everywhere. So there's no reason every consumer should rebuild it. We should build once, publish, and let consumers pull it.

Proposal

Three parts, phased:

1. Publish prebuilt mobile binaries as GitHub Release assets ← Phase 1 (this issue's first PR)

A tag-triggered workflow (v*) cross-compiles via build-mobile.sh on the right runners and attaches to the GitHub Release:

• WardenFfi.xcframework.zip (iOS, built on macos-latest)
• warden-ffi-android-jniLibs.zip (Android 4-ABI, built on ubuntu-latest)
• SHA256SUMS

Tag-triggered (not per-merge) so the binary version stays in lockstep with the warden_ffi pub.dev version — both are cut from the same tag. A redeploy of any consuming app is irrelevant here (the gate crypto bakes in no on-chain addresses). Also add a path-filtered build-check CI (PR + push to main, scoped to core/**, ffi/**) that cross-compiles both platforms and runs the FFI host test, so a break in the mobile build surfaces early without cutting a release.

2. Publish a warden_ffi_flutter wrapper plugin to pub.dev ← Phase 2 (follow-up PR)

A thin Flutter plugin that depends on the pure warden_ffi binding and adds the ios/ podspec + android/ gradle that download the Phase-1 release binary at build time. Consuming apps then add one dependency — flutter pub get + flutter build pulls everything, no Rust toolchain on any dev/CI machine. The pure warden_ffi stays pure (desktop/CLI/host tests keep supplying a dylib path).

Open decision for that PR: iOS currently ships a static lib force-loaded via OTHER_LDFLAGS (symbols resolved at runtime through DynamicLibrary.process()). A pod is friendlier with a dynamic framework (cdylib packaged as .framework, loaded via DynamicLibrary.open), which removes the -force_load wiring from the consumer. This needs real-device verification, which is why it's a separate PR.

3. Docs

Update ffi/README.md, ffi/dart/README.md, and the top README.md so "how to consume on mobile" reflects: download the release binary (Phase 1) and eventually just add warden_ffi_flutter (Phase 2). Build-from-source instructions stay for warden developers.

Why GitHub Releases (not GitHub Packages)

GitHub Packages has no pub or CocoaPods/SwiftPM registry (only its Maven registry would fit Android), and its Maven registry requires a token even for public reads. A GitHub Release asset downloads anonymously on a public repo and is consumable from both a podspec and gradle — one store, all platforms, no auth.

Tasks

• Phase 1: mobile-release.yml (tag v* → build iOS + Android → Release assets + checksums)
• Phase 1: mobile-ci.yml (PR/main build-check, path-filtered, + FFI host test)
• Phase 1: docs — releases are the artifact source
• Phase 2: warden_ffi_flutter plugin (podspec + gradle download the pinned release) → pub.dev
• Phase 2: decide + verify iOS static-force_load vs dynamic-framework on a real device
• Phase 2: docs — warden_ffi_flutter as the turn-key Flutter path; update consumer (maktub-app) CLAUDE.md

Non-goals

• Auto-tagging / releasing on every merge (decouples binary from the published binding version).
• Committing binaries into any repo.
• Touching the wasm/ (JS SDK) track — that's a separate consumer.

Status: Phase 0 PoC — these binaries are publishable, not audited. The "preview" framing is unchanged.

[nandal]

✅ Done — both phases shipped and verified on a real device

Phase 1 — publish prebuilt binaries

• mobile-release.yml — v* tag → builds iOS xcframework + Android jniLibs → Release assets + SHA256SUMS
• mobile-ci.yml — path-filtered build-check (cross-compile both platforms, FFI host test, symbol assertion, plugin analyze/dry-run)
• docs — README / ffi/README.md / ffi/dart/README.md point at the release assets
• Shipped in ci(ffi): publish prebuilt mobile binaries as Release assets (#4) #5. Releases: v0.1.0-dev.1 (static) and v0.1.0-dev.2 (dynamic).

Phase 2 — warden_ffi_flutter plugin

• Plugin (ffi/flutter/): podspec downloads + embeds the dynamic WardenFfi.framework; gradle downloads jniLibs → published to pub.dev 0.1.0-dev.1
• iOS static-vs-dynamic decision: went dynamic framework (CocoaPods embeds + signs it; symbols load at launch → DynamicLibrary.process(), no -force_load). build-mobile.sh gained an ios-framework mode.
• Verified on a real iPhone (iOS 26.6, over WiFi): build → embed → sign → devicectl install all clean, and Veil loads at runtime (beat creation works). Verified twice — with the git ref and with the hosted pub.dev package.
• docs + consumer swap: maktub-app now depends on the hosted warden_ffi_flutter (bytesbrains/maktub-app#3, merged); its CLAUDE.md + the warden docs describe the turn-key flow.
• Shipped in feat(ffi): warden_ffi_flutter plugin + dynamic-framework iOS build (#4) #6.

Outcome: any Flutter app consumes the Veil bridge with a single pub.dev dependency — no Rust toolchain, no manual binary fetch, no Xcode/Gradle wiring. Closing as complete.

[nandal]

📦 pub.dev package — warden_ffi_flutter

https://pub.dev/packages/warden_ffi_flutter

Version	0.1.0-dev.1 (pre-release)
Published	2026-06-23
Description	Flutter plugin that bundles the Warden native FFI library (the Veil bridge) — a threshold conditional-decryption gate — so an app gets it with no Rust toolchain and no native build wiring. Wraps the warden_ffi binding.
SDK constraints	Dart ^3.4.0, Flutter >=3.10.0
Dependencies	flutter, warden_ffi ^0.1.0-dev.1
Platforms	iOS, Android (FFI plugin)
Source	ffi/flutter/ in this repo

Use

dependencies:
  warden_ffi_flutter: 0.1.0-dev.1

import 'package:warden_ffi_flutter/warden_ffi_flutter.dart';

final warden = WardenFfi.load(); // bundled native lib — no path on device
final id = warden.conditionIdentity(conditionJson);

How the native library is delivered

Binaries aren't shipped in the package (4 KB archive — Dart + podspec + gradle only). They're pulled at build time from this repo's Release v0.1.0-dev.2:

• iOS — the podspec's prepare_command downloads the dynamic WardenFfi.xcframework; CocoaPods embeds + signs it; dyld loads it at launch → symbols resolve via DynamicLibrary.process() (no -force_load).
• Android — build.gradle downloads jniLibs/<abi>/libwarden_ffi.so and adds it as a source set.

The pinned native release tag (warden_tag / WARDEN_NATIVE_TAG) is kept in lockstep with the package version.

⚠️ Preview / Phase-0 PoC — publishable, not audited. The timing guarantee is not security on the test federation.