MobileCode v0.1.77

Release type: security hardening pre-release patch.

Scope

Remove raw managed-provider API keys, DeepSeek keys, relay bearer tokens, and OAuth client secrets from every public Android and iOS build workflow.
Allow only non-secret public configuration in distributed binaries: managed relay URL, OAuth client ID, and OAuth redirect URI.
Enable managed MiMo/DeepSeek presets in public builds only when a relay URL is configured; otherwise users provide their own key through MobileCode's secure-storage flow.
Add a fail-closed repository policy check to every public build job so a later workflow edit cannot silently restore forbidden credential inputs.
Preserve the MobileCore v2 handshake, model controls, adaptive local routing, attachment capability gates, cancellation, and redacted ActionEvidence behavior from v0.1.76.
Keep MobileCore as the local inference engine and MobileCode as the orchestration, Phone Use, approval, and evidence authority.

Policy unit tests reject forbidden secret references and runtime-key Dart definitions while allowing release-signing secrets and public configuration.
All public release workflows pass the credential policy and YAML parsing checks.
A clean pureRelease APK reports 0.1.77+67, contains no recognizable managed-provider credential values, and verifies with the MobileCode release certificate before publication.
The exact published APK installs and cold-launches on the Android emulator. A controlled MobileCore local request remains a separate open gate until MobileCore preserves foreground-service state across notification updates.
Emulator evidence does not satisfy physical-device thermal, background-recovery, controlled-account, or verified Omni audio gates.

Android workflow 31128587598 passed the credential policy, source analysis, release signing, APK build, version check, artifact upload, and Release upload from merge commit d031692.
The downloaded mobilecode-v0.1.77.apk is 33,046,287 bytes with SHA-256 f008ede0e0305c835c3bf45bcc56f22c4fc911d0ae10b513f298d1bdfb0a1c1d; that matches the GitHub asset digest and reports 0.1.77+67.
APK Signature Scheme v2 verifies with certificate subject CN=MobileCode, OU=MobileCode, O=Harzva, L=Shanghai, ST=Shanghai, C=CN and certificate SHA-256 35a6eee3e2d81d4c6b5d426984d1b04d7d5ffc3eae7707c6225f5decd80fa2da.
Post-download AOT scanning found zero recognizable provider-key, GitHub-token, bearer-token, JWT, or private-host-path patterns. The workflow log also contained zero forbidden runtime-credential variable names.
After a clean install, Android reported version code 67 and version name 0.1.77; the UI rendered v0.1.77, the process stayed alive, and logcat contained no fatal exception, ANR, OOM, or SIGABRT marker.
MobileCore 0.1.4-rc4 still passed its v2 health and model-load controls while foregrounded. When MobileCode became active, Android reported MobileCore's service as isForeground=false and froze its process despite the visible notification, so the exact published APK's local-chat pairing is deliberately not claimed yet.