epic: ship iOS build to TestFlight with CI

[dzianisv]

Outcome

Ship a production-ready iPhone/iPad build of OpenCode Mobile to TestFlight, with an iOS build gate on every pull request and a single, fail-fast release path.

Done means:

• every PR produces a valid iOS JavaScript bundle and unsigned iOS Simulator build;
• release automation builds once and submits the exact EAS build to TestFlight;
• iOS permissions, icon, bundle identifier, metadata, and App Store assets are valid;
• the first build is visible in App Store Connect/TestFlight.

Epic 1 — Native iOS readiness

• Add the local-network privacy usage description required to reach LAN opencode servers.
• Remove the alpha channel from the 1024×1024 App Store icon.
• Verify Expo config/plugin resolution and generate the native iOS project cleanly.
• Export the production JavaScript bundle for iOS.
• Build the generated app for an iPhone Simulator without code signing.
• Exercise connection, session list, chat, permissions, image picker, speech, biometrics, notifications, and keyboard behavior on iPhone.
• Exercise the same critical path on iPad because supportsTablet is enabled.

Epic 2 — Pull-request CI

• Add a dedicated iOS workflow for pull requests and main pushes.
• Run dependency install, Expo config validation, iOS export, prebuild, CocoaPods install, and xcodebuild on macOS.
• Add concurrency cancellation and artifact/log retention for failed native builds.
• Keep the existing platform-neutral typecheck/tests as prerequisites.

Epic 3 — TestFlight release automation

• Remove duplicate tag/release triggers so one release creates one iOS build.
• Pin current EAS CLI and use deterministic dependency installation.
• Fail fast instead of reporting success when Apple/EAS credentials are absent.
• Validate App Store Connect and Apple Team identifiers before consuming an EAS build.
• Parse and submit the exact EAS build ID; do not use an ambiguous “latest” build.
• Add concurrency protection and persist the EAS build metadata as a workflow artifact.
• Add the production EAS/App Store Connect credentials after Apple enrollment.
• Run the workflow and confirm the build appears in TestFlight.

Epic 4 — Store and launch readiness

• Replace stale ai.opencode.mobile references with cc.agentlabs.opencode in iOS launch docs.
• Normalize the Apple account email to support@agentlabs.cc.
• Correct stale claims about icon/screenshots and record the current asset inventory.
• Validate App Store listing, privacy disclosures, export compliance, review notes, and review-server instructions.
• Create the App Store Connect app record and fill ascAppId/appleTeamId.
• Create the internal TestFlight group and add testers.
• Update README/download surfaces only after the TestFlight install path is real.

Current blockers

Remaining launch gates require Apple/EAS access on macOS: verify enrollment and agreements, create the App Store Connect record, replace ascAppId/appleTeamId, add EXPO_TOKEN and App Store Connect API credentials, bootstrap EAS signing, capture fresh iPhone/iPad screenshots, and configure TestFlight testers. The release workflow now fails fast when required configuration is absent.

Website rollout

• Publish accurate iOS implementation progress without claiming availability.
• Verify the live iOS and privacy pages on GitHub Pages.
• Run the mandatory Android CUA regression on the final PR commit.

[dzianisv]

Implementation is committed and PR #66 is open: #66

Linux verification completed: TypeScript, all 81 tests, Expo iOS introspection/export/prebuild, generated local-network permission, RGB App Store icon, workflow YAML/shell validation, and a two-pass independent code review. The website progress update was pushed to gh-pages in 4fcbdf3; live Pages verification is running.

The PR's new macOS job is the remaining automated native proof. Mac/Apple gates remain intentionally open: Simulator launch and iPhone/iPad smoke test, fresh screenshots, Apple enrollment/App Store record, Expo project/signing bootstrap, GitHub credentials/IDs, and first TestFlight install.

[dzianisv]

macOS proof passed on the current PR commit: iOS CI run 29311548316 completed CocoaPods and the unsigned iOS Simulator xcodebuild in 3m47s.

[dzianisv]

Final automated regression evidence on commit f9b18a0:

• CUA Smoke Test 29311571434 completed successfully. Core connect, session-list, new-session, reload, and coding-result verification phases passed.
• iOS CI 29311548316 passed typecheck/tests, CocoaPods, and unsigned Simulator compilation.
• Android build 29311548325 passed tests and APK compilation.
• PR #66 now has all required checks green.
• Live rollout pages remain verified: iOS progress and privacy policy.

The implementation/CI foundation is complete. Remaining open checklist items are genuine Mac/Apple gates: manual iPhone/iPad QA and screenshots, App Store Connect record/IDs, credentials/signing bootstrap, and first TestFlight install.

[dzianisv]

Notion final sync completed: CUA run 29311571434 is now recorded as passed, required PR checks are green, and remaining blockers are limited to Apple/EAS/TestFlight setup. Browser automation guidance moved from the retired chrome-devtools MCP to VibeBrowser CLI in commit c287eca.

[dzianisv]

Owner merge gate completed. PR #66 merged as cbe00c3 after final review and all final-head checks.

Post-merge monitoring:

• main iOS CI 29357187077 — passed
• main Android build 29357187974 — passed
• main CUA 29357189655 — passed
• Google Play — published
• Website/privacy/self-hosted F-Droid — healthy
• F-Droid mainline — still HTTP 404; overall production-readiness check remains blocked on mainline publication only

Notion owner checklist is updated with the completed review/merge/monitoring gates and the remaining F-Droid blocker.

[dzianisv]

Status update (2026-07-16) — code automation done, blocked on Apple enrollment

All code-side iOS automation is merged (PR #66): app.json iOS-ready (bundle cc.agentlabs.opencode, usage strings, ITSAppUsesNonExemptEncryption:false), eas.json profiles (2 placeholders left), CI (ios-ci.yml PR gate + publish-app-store.yml → EAS Build → EAS Submit → TestFlight), and runbooks (distribution/ios-enrollment-runbook.md, distribution/app-store-listing.md).

No Apple/EAS credentials exist yet (checked Bitwarden + repo secrets).

Remaining = human-gated Apple steps (cannot be automated)

1. Apple ID support@agentlabs.cc + 2FA
2. Enroll VIBE TECHNOLOGIES, LLC in Apple Developer Program ($99/yr, org, D-U-N-S 142059652) — expect a verification call (2–5 business days)
3. Pay $99
4. Accept Program License + Paid Applications agreements
5. App Store Connect banking/tax (EIN 606 003 933)
6. Create app record (cc.agentlabs.opencode) → note ascAppId + Apple Team ID
7. Create App Store Connect API key (App Manager) → download .p8, note Key ID + Issuer ID

Then fully automatable (hand over the .p8 + IDs from 6–7):

• Store .p8/IDs in Bitwarden + GitHub secrets (EXPO_TOKEN, APPLE_APP_STORE_CONNECT_*, EAS_PROJECT_ID)
• Fill eas.json placeholders (ascAppId, appleTeamId) via PR
• eas init, bootstrap managed iOS signing, capture screenshots
• Trigger publish-app-store.yml → verify TestFlight processing + tester install

Blocker: step 2 (enrollment + verification). Everything downstream is ready.

[dzianisv]

Final state (2026-07-17): one human session away from TestFlight

Everything automatable is done and merged. Verified right now: repo secrets have Sentry + Play + keystores but no EXPO_TOKEN / no ASC API key; eas.json still has the 2 placeholders; no Apple/Expo items in Bitwarden.

The one human session (~30–45 min + $99), in order — runbook: distribution/ios-enrollment-runbook.md (all entity data pre-filled, D-U-N-S 142059652 already active)

1. Create/sign in Apple ID support@agentlabs.cc (https://appleid.apple.com) → save to Bitwarden as APPLE_ID_VIBE_TECHNOLOGIES.
2. Enroll at https://developer.apple.com/programs/enroll/ as Company/Organization (pre-filled table in runbook) — $99 charge + Apple verification call to the governor.
3. After approval: App Store Connect → Users and Access → Integrations → create App Store Connect API key (App Manager role) → save .p8 + Key ID + Issuer ID to Bitwarden (ASC_API_KEY_VIBE).
4. Create a free Expo account (https://expo.dev) → generate access token → Bitwarden as EXPO_TOKEN_VIBE.
5. In App Store Connect, create the app record: bundle cc.agentlabs.opencode, name per distribution/app-store-listing.md → note the numeric Apple App ID and Team ID.

Then the agent side takes over (say 'go iOS' in a session)

• Fill eas.json ascAppId/appleTeamId from step 5, commit.
• gh secret set EXPO_TOKEN + ASC key material; add Sentry env vars to the EAS production environment (gap flagged in the Sentry audit).
• Trigger publish-app-store.yml → EAS Build → EAS Submit → TestFlight, and watch it to green.

No code work remains on this epic.