Ship combined refresh runtime, guest controls, and v2.0.0 documentation

[NRG-Wardog]

Changes

• Shared embedded authentication, startup/navigation fixes, and Wi-Fi/LocalDevVPN foreground preflight.
• Correlated refresh verification across XPC, reactive status, preserved retry timing, and history improvements.
• Movable/collapsible guest Return control, LiveProcess ownership and resume safety, windowed/fullscreen visibility.
• Stable v2.0.0 release notes, current README, and variant-specific verification/compatibility documentation.

Verification

Published binary: f20e14e.
CI 34238644076 passed: 76 tests, 2 skipped; both Release builds and combined artifact verification.
Following documentation-only updates: local suite passed, 65 tests with 16 compiler-dependent skips; diff checks passed.
No new IPA build needed for documentation.

Device limits

Earlier embedded UI/Return interaction and verification-result transfer observed. Final automatic windowed visibility, same-PID resume, complete host replacement, and unattended combined refresh are not claimed proven by CI.
Existing screenshots remain explicitly labeled standalone until replacement images are supplied.

[NRG-Wardog]

Corrective build and artifact verification completed

The original guest-return build at 9888cc1 (run 34141748119) succeeded. The audit nevertheless identified source-level multitasking/ownership risks; commit eab210064dbf67d5d24f87bf09891ce531b1386b fixes those without modifying refresh transport, authentication, signing or history.

Build

• Corrective combined build: https://github.com/NRG-Wardog/sidestore-auto-refresh/actions/runs/34143358381 — success.
• Built commit: eab210064dbf67d5d24f87bf09891ce531b1386b.
• IPA artifact: 10027036023 (LiveContainer-SideStore-AutoRefresh-IPA).
• Evidence artifact: 10027036685 (livecontainer-autorefresh-build-evidence).
• Actual IPA size: 37,329,594 bytes.
• Actual IPA SHA-256: 2ab57afd15b1a6197c1fc5306aae3e4e6b32488064718d9df966e913fc70d336.

Verification performed

CI repository suite: 60 tests, 58 passed, 2 skipped. All 7 guest-return tests passed, including the pinned-source/idempotence test and real execution of the injected Swift registry and C positioning helper. The two existing embedded-startup tests still skip because their fixture paths are hard-coded; separate pinned-source preflight and both full Release targets passed. No skipped test is counted as passed.

Additional local stress used the actual injected registry with platform doubles: 200 cycles of eight guests (1,600 simulated guest cases), shuffled completion order, existing-instance selection, process-death cleanup and stale-generation callbacks all passed. This is logic testing, not 1,600 real iOS processes or device validation.

Downloaded-artifact verification independently passed: exact builder commit, ZIP integrity, main host and all four extensions, dylibified embedded SideStore, new return-control and registry markers in the host UI binary, all five CoreDevice transport markers, absence of the obsolete IPSec rejection text, and processing/fetch BG allowlist. The manually calculated IPA hash agrees with both CI verification JSON files. Main host minimum OS remains 15.0; AlarmKit is weak-linked where present. Compiler/dependency warnings remain; the build is not warning-free.

Multitasking behavior and scope

Hosted LiveProcess Return still calls upstream minimizeWindow, never the termination/restart path. Native-window Return requests activation of the captured host main scene without closing the guest scene. Reopening prefers the retained instance. Each native launch now has a generation-specific window ID and its own consumed-once callback; cleanup releases the old container before delegate-driven relaunch. Virtual-window resume uses the actual owning window, and an unresolved but still-owned container cannot be opened as a duplicate.

The draggable control remains event-driven, touch-transparent outside its button, with bounded positioning and persistence only at drag completion. No periodic probes, fake audio, or extra VPN/keepalive traffic were introduced.

Remaining acceptance / limitations

No physical-device validation was performed. Still test same PID and interaction state across Return/reopen, separate-window host activation, multiple guests, guest death while minimized, repeated minimize/resume animation, rotation, keyboard and accessibility. Upstream private scene hosting/lifecycle behavior is retained; hiding a guest is not verified suspension and may leave audio/network/rendering active. iOS can terminate retained processes under resource pressure. Direct host-process execution retains restart semantics; this patch does not add generic direct-guest memory preservation.

The corrected candidate is on fix/combined-refresh-build-and-runtime in this draft PR. No merge to main or public release was performed in this audit. Install the test candidate over the same-team existing installation without deleting guest data.

[NRG-Wardog]

Embedded authentication / shared Keychain fix — build verified, device acceptance pending

Implemented at 3276c8fcb63dee69c280f992726bc9e23d095a75; final built head bcf9c64b5a275d68c73b2fd28c75551a774a90e8.

Source defect addressed

The embedded SideStore Keychain client supplied a service but no explicit access group. At the reported isideload revision 3d42025, the LiveContainer host receives shared keychain groups while extensions receive their profile entitlements unchanged. This can place the UI's saved login outside the background process's default group. The failing user screenshot proves our preflight found no accessible authentication path, but the installed device's exact entitlements and Security return statuses have NOT been captured; do not claim that source inspection alone proves the device root cause.

The combined build now explicitly uses the actual App Group resolved by the existing SideStore identity hooks as its Keychain access group. iOS supports App Groups for Keychain sharing; no new entitlement, App ID, signing team or installer modification is introduced. Reference: https://developer.apple.com/documentation/security/sharing-access-to-keychain-items-among-a-collection-of-apps

Implementation

• Coherent legacy migration is scoped to the exact SideStore service and access groups already visible to the process. It never combines account-ID/token halves from different groups or overwrites a conflicting login.
• Existing credentials/certificates are copied and read back for verification. Originals are retained. Authentication readers ignore an incomplete migration until its commit marker is written.
• An extension-first launch with no visible legacy login performs no migration writes, so it cannot prevent the UI from migrating later.
• Sign-out/clear retain a migration tombstone; the new code does not resurrect an old saved login afterward.
• Imported-certificate reads retain a read-only legacy fallback before login migration.
• Authentication checks and real upstream authentication remain. The preflight was NOT bypassed. Missing credentials, transient access failures, entitlement/configuration failures, conflicting logins and other numeric Keychain errors receive distinct messages where Security supplies a distinguishable status.
• Diagnostics log item names/status/PID, never credential values, full queries or error userInfo. No credentials in preferences, normal files or XPC; no timers/network probes added.

Changed files: scripts/patch_embedded_keychain.py, scripts/templates/embedded_shared_keychain.swift, scripts/patch_combined_refresh_contract.py, tests/test_embedded_keychain.py, tests/test_repository.py. Standalone transport, combined transport, signing, guest return, history and scheduling engine are unchanged by these commits.

Build and tests

• Final combined run https://github.com/NRG-Wardog/sidestore-auto-refresh/actions/runs/34148513224 — success.
• Repository tests: 63 total, 61 passed, 2 skipped. The two skips are existing startup tests with hard-coded local fixture paths; they are not counted as passes.
• All three new Keychain tests passed, including 16 optimized Swift scenarios using the exact shipped adapter/migration source with isolated Security/Keychain doubles, and patch idempotence on the real pinned SideStore source.
• Additional local full-wrapper typecheck/execution passed with platform doubles. These are logic tests, not real iOS securityd or an Apple account test.
• The first fast run stopped only because the exact script inventory had not yet listed the new patch; the inventory and wiring checks were updated without disabling assertions. The second run passed both full Release targets, packaging, runtime contract and transport checks.
• Compiler warnings remain, including the new no-prompt Security query's deprecated kSecUseAuthenticationUIFail constant. This is not a warning-free build.

Downloaded artifact verified independently

• IPA artifact: 10028836048 (LiveContainer-SideStore-AutoRefresh-IPA).
• Evidence artifact: 10028836328.
• Actual IPA bytes: 37,347,893.
• Actual IPA SHA-256: feb4a064157cd409b32111107919c59291ad45a336ea45bf66c42e00cbdf4381.
• Confirmed builder SHA, ZIP integrity, shared-Keychain/migration markers inside the embedded executable, all four extensions/five registration targets, all five CoreDevice markers, retained history/return UI, background allowlist and fetch/processing modes, minimum host iOS 15.0 and weak AlarmKit linkage. IPA hash matches both CI verifier JSONs. The prior generic preflight message is absent from the embedded executable.

Required device acceptance

Install over the existing same-team combined application without deleting guest data or signing out. Open embedded SideStore in that SAME installation once, so the process that can access the legacy login can migrate it. Then return to the host settings and press Refresh SideStore now. Confirm LC_KEYCHAIN shared-group/migration diagnostics, AUTH_PREFLIGHT_PASS, and the actual refresh/install/host-verification outcome. If access still fails, capture the new numeric status plus installed host/LiveProcess entitlements before changing signing behavior.

No physical-device migration, actual refresh, Apple account signing or energy measurement was performed here. This is a build-verified test candidate on the existing draft PR; no merge to main or public release was made.

[NRG-Wardog]

Integrated into main as GitHub-verified signed commit ac8245e. The original squash merge was blocked by the required-signature policy; no rule was bypassed or weakened. Confirmed git diff --exit-code origin/main 69734af is empty: main contains the exact reviewed/tested file tree. Published IPA remains f20e14e from successful run 34238644076; subsequent changes are documentation only. Closing this PR as integrated.