chore(sync): merge Silo-Server/silo-android main (238 commits)

.github/workflows/android-build.yml

@@ -1,12 +1,9 @@
 name: Android Builds
 
-# CI gate: :shared debug unit tests + Kover line-coverage verify (commonMain).
-# Floor is 95% line coverage across commonMain (androidMain / Koin / serializers
-# excluded — see shared/build.gradle.kts). App-module unit tests (androidApp /
-# androidTvApp / android-shared) are not part of this gate and are skipped here
-# to keep the longest client CI focused on the shared coverage contract.
-# Release artifacts (Play Store bundles, sideload APKs, GitHub releases) are
-# owned by release.yml — triggered by v* tags or its workflow_dispatch.
+# CI gate: unit tests + Kover line-coverage verify on :shared commonMain, plus
+# lint. Floor is configured in shared/build.gradle.kts. Release artifacts
+# (Play Store bundles, sideload APKs, GitHub releases) are owned by
+# release.yml — triggered by v* tags or its workflow_dispatch.
 
 on:
   push:
@@ -47,20 +44,47 @@ jobs:
       - name: Set up Gradle
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
 
-      - name: Run :shared unit tests and coverage gate
+      # Robolectric does NOT resolve its Android runtimes through Gradle. At test
+      # execution time it fetches android-all-instrumented straight from Maven
+      # Central into ~/.m2, which setup-gradle's cache does not cover — so every
+      # run re-downloaded 85-204 MB per SDK level. On 2026-08-11 Maven Central
+      # answered 403 and took out 31 unrelated tests in android-shared, and the
+      # download time is a large part of this job.
+      #
+      # Which runtimes get fetched depends on the Robolectric version AND on the
+      # SDK each test resolves to, so the key hashes the version catalogue and
+      # the module build files (min/target SDK) together. A new @Config(sdk=NN)
+      # in a test is deliberately NOT in the key: hashing test sources would
+      # bust this cache on nearly every pull request, which costs more than it
+      # saves. The residual gap is bounded — that one runtime is re-fetched each
+      # run until something else moves the key — and the restore-key prefix
+      # still seeds from the previous cache rather than starting cold.
+      #
+      # A run-id-suffixed key would close the gap by saving every run, but this
+      # cache is hundreds of MB; a new entry per run would evict the Gradle
+      # cache against the repository's 10 GB budget.
+      - name: Cache Robolectric Android runtimes
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ~/.m2/repository/org/robolectric
+          key: robolectric-${{ runner.os }}-${{ hashFiles('gradle/libs.versions.toml', '**/build.gradle.kts') }}
+          restore-keys: |
+            robolectric-${{ runner.os }}-
+
+      - name: Run unit tests and coverage gate
         shell: bash
         run: |
           set -euo pipefail
 
-          # Only :shared debug unit tests feed the Kover commonMain gate.
-          # Release unit tests are disabled on :shared (see build.gradle.kts).
-          # App modules are intentionally out of this job.
+          # Debug-variant unit tests only. The release variant compiles and runs
+          # the exact same sources for no extra signal, and doubles CI time.
+          # :shared koverXmlReport/koverVerify enforce the commonMain coverage floor.
           ./gradlew \
             -Dorg.gradle.jvmargs="-Xmx4g -Dfile.encoding=UTF-8" \
-            :shared:testDebugUnitTest \
+            testDebugUnitTest \
             :shared:koverXmlReport \
             :shared:koverVerify \
-            --max-workers=4 \
+            --max-workers=2 \
             --no-configuration-cache
 
       - name: Upload test reports
@@ -80,3 +104,55 @@ jobs:
           path: |
             **/build/reports/kover/**
           if-no-files-found: ignore
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out sources
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        with:
+          distribution: temurin
+          java-version: "21"
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
+
+      - name: Run lint
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # NewApi and InlinedApi are fatal here. Two startup crashes reached
+          # users because nothing checked API levels: a Spatializer call gated
+          # at 31 for a class introduced at 32, and an unguarded API 28 call.
+          # Existing findings are held in per-module lint-baseline.xml, so only
+          # NEW violations fail. If this job fails, fix the call — do not
+          # regenerate the baseline to make it pass.
+          #
+          # lintVitalRelease runs here too. checkReleaseBuilds makes it part of
+          # assembleRelease, which only ever runs from release.yml on a v* tag —
+          # so without this the release variant is gated by a check that no pull
+          # request exercises, and the first run would be mid-release. It also
+          # covers the release-only source sets that lintDebug never sees.
+          ./gradlew \
+            -Dorg.gradle.jvmargs="-Xmx4g -Dfile.encoding=UTF-8" \
+            :android-shared:lintDebug :androidApp:lintDebug :androidTvApp:lintDebug \
+            :androidApp:lintVitalRelease :androidTvApp:lintVitalRelease \
+            --max-workers=2
+
+      - name: Upload lint reports
+        if: failure()
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        with:
+          name: lint-reports
+          path: |
+            **/build/reports/lint-results-*.html
+            **/build/reports/lint-results-*.xml
+          if-no-files-found: ignore

.github/workflows/release.yml

@@ -1,13 +1,13 @@
 name: Release
 
-# One release pipeline, playing the role of prairie-apple's TestFlight
+# One release pipeline, playing the role of silo-apple's TestFlight
 # (release.yml) and sideload (sideload-ipa.yml) workflows combined: a version
 # tag or a manual dispatch publishes both App Bundles to Google Play, then
 # builds the signed sideload APKs and attaches them to a GitHub release for
 # the same version. Dispatch runs mint the v<version> tag when creating the
 # GitHub release — no manual tagging is necessary (apple's sideload pattern).
 #
-# Versioning mirrors prairie-apple's marketing-version + build-number split.
+# Versioning mirrors silo-apple's marketing-version + build-number split.
 # Play itself has no such split — versionCode is the only monotonic counter,
 # and versionName is a free-form display string that may repeat. So a build
 # number is folded into the versionCode while versionName stays put, letting
@@ -125,6 +125,13 @@ jobs:
               echo "::error::Tag must look like v1.2.3, v1.2.3+2, or v1.2.3-rc.1."
               exit 1
             fi
+            # A prerelease suffix deliberately does NOT feed the build counter.
+            # The counter is folded into the versionCode, so deriving it from
+            # -rc.N would make a sideloaded v1.2.3-rc.2 (base+2) outrank the
+            # official v1.2.3 (base+1) and block that upgrade on the device —
+            # and it would still not tell -rc.2 apart from +2, which resolve to
+            # the same counter. Prerelease artifacts are distinguished by their
+            # tag; see the note in the PR for the reporting limitation.
             if [[ "${version}" == *+* ]]; then
               build="${version##*+}"
             else
@@ -187,6 +194,7 @@ jobs:
 
       - name: Check build supply chain
         run: |
+          ./scripts/test-release-workflow.sh
           ./scripts/test-check-build-supply-chain.sh
           ./scripts/check-build-supply-chain.sh
 
@@ -316,7 +324,7 @@ jobs:
             exit 1
           fi
 
-          keystore_path="${RUNNER_TEMP}/prairie-release.jks"
+          keystore_path="${RUNNER_TEMP}/silo-release.jks"
           printf '%s' "${KEYSTORE_B64}" | base64 -d > "${keystore_path}"
           echo "PRAIRIE_RELEASE_KEYSTORE=${keystore_path}" >> "${GITHUB_ENV}"
 
@@ -343,24 +351,29 @@ jobs:
         shell: bash
         env:
           PRAIRIE_VERSION_NAME: ${{ needs.setup.outputs.version_name }}
+          PRAIRIE_DISPLAY_VERSION: ${{ needs.setup.outputs.version }}
           PRAIRIE_VERSION_CODE: ${{ needs.setup.outputs.version_code }}
           PRAIRIE_RELEASE_KEYSTORE_PASSWORD: ${{ secrets.PRAIRIE_RELEASE_KEYSTORE_PASSWORD }}
           PRAIRIE_RELEASE_KEY_PASSWORD: ${{ secrets.PRAIRIE_RELEASE_KEY_PASSWORD }}
           PRAIRIE_RELEASE_KEY_ALIAS: ${{ secrets.PRAIRIE_RELEASE_KEY_ALIAS }}
+          PRAIRIE_BUILD_NUMBER: ${{ needs.setup.outputs.build_number }}
         run: |
           set -euo pipefail
 
           ./gradlew \
             -Dorg.gradle.jvmargs="-Xmx4g -Dfile.encoding=UTF-8" \
             ":${{ matrix.module }}:assembleRelease" \
             "-PprairieVersionName=${PRAIRIE_VERSION_NAME}" \
+            "-PprairieDisplayVersion=${PRAIRIE_DISPLAY_VERSION}" \
             "-PprairieVersionCode=${PRAIRIE_VERSION_CODE}" \
+            "-PprairieBuildNumber=${PRAIRIE_BUILD_NUMBER}" \
+            "-PprairieReleaseChannel=sideload" \
             --max-workers=2
 
       - name: Collect release APKs
         shell: bash
         env:
-          PRAIRIE_VERSION_NAME: ${{ needs.setup.outputs.version_name }}
+          PRAIRIE_VERSION_NAME: ${{ needs.setup.outputs.version }}
         run: |
           set -euo pipefail
 
@@ -391,12 +404,16 @@ jobs:
 
   # Create or update the GitHub release and attach the APKs. For dispatch
   # runs the tag does not exist yet — gh release create mints it at the
-  # released commit (--target), mirroring prairie-apple's sideload workflow, so
+  # released commit (--target), mirroring silo-apple's sideload workflow, so
   # no manual tagging is necessary. Tags created with GITHUB_TOKEN do not
   # re-trigger workflows, so this cannot recurse.
   publish-release:
     name: Publish GitHub Release
     needs: [setup, apks]
+    if: >-
+      ${{ !cancelled() &&
+          needs.setup.result == 'success' &&
+          needs.apks.result == 'success' }}
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -418,7 +435,7 @@ jobs:
           set -euo pipefail
           shopt -s globstar nullglob
 
-          release_title="Prairie Android ${RELEASE_TAG}"
+          release_title="Silo Android ${RELEASE_TAG}"
           android_latest_url="https://github.com/${GH_REPO}/releases/latest/download/prairie-android-latest-universal-release.apk"
           android_tv_latest_url="https://github.com/${GH_REPO}/releases/latest/download/prairie-android-tv-latest-universal-release.apk"
           android_downloader_url="http://aftv.news/1051382"

.superpowers/sdd/2026-07-27-pr108-slice-f-watch-together/task-1-report.md

@@ -45,7 +45,7 @@ owner-driven cancellation remains silent.
 ### Credential boundary
 
 The access token is still required to attempt the room socket but is no longer
-placed in the request target. The existing same-origin Silo auth plugin adds
+placed in the request target. The existing same-origin Prairie auth plugin adds
 `Authorization`, `X-Profile-Id`, and `X-Profile-Token` headers. The server
 currently still requires `room_token`, `profile_id`, and `profile_token` query
 parameters; the client KDoc records that residual request-target exposure.
@@ -213,9 +213,9 @@ The exact-scope validation at connect start is not the final token read: the
 auth plugin reads the scoped token again while building the request so it can
 honor rotation. A credential scope can disappear between those reads. The
 Watch Together connector now marks its pinned request with the internal,
-opt-in `requireSiloAuth()` attribute. When that marked request's exact scoped
-token is null or blank, `PrairieAuthPlugin` removes Silo headers and throws before
-the engine runs. Unmarked public requests and `skipSiloAuth()` paths retain
+opt-in `requirePrairieAuth()` attribute. When that marked request's exact scoped
+token is null or blank, `PrairieAuthPlugin` removes Prairie headers and throws before
+the engine runs. Unmarked public requests and `skipPrairieAuth()` paths retain
 their existing behavior.
 
 ### Correction 2 TDD evidence