1Helm 0.0.13

1Helm 0.0.13

1Helm 0.0.13 adds secure thin mobile gateways for an already configured 1Helm host. Android is distributed directly as one permanently signed universal APK. The iPhone/iPad source, native project, and App Store archive automation are included; the App Store build remains pending until full Xcode and Apple distribution provisioning are installed on the retained Apple build host.

Acceptance ledger

1. Thin gateway only: The native app asks for an HTTPS server address, username, and password. It never initializes or exposes first-run setup for the remote host.
2. Apple support: A native iPhone/iPad Capacitor target, stable bundle ID, privacy declarations, deep-link callback, and App Store archive/export automation are versioned. Full Xcode and an Apple Distribution provisioning identity are not yet present on the release Mac, so no App Store/TestFlight upload is claimed in this release.
3. Direct Android distribution: The release builds a signed universal APK without Google Play, fails closed without the retained external signing material, and pins the permanent release-certificate fingerprint.
4. Credential handling: The password is cleared immediately after submission and is never retained. The session lives in device-only iOS Keychain or Android Keystore-backed encrypted storage.
5. Remote web parity: REST, WebSocket, files, media, avatars, photos, OAuth, and external-link handling route through the chosen HTTPS host while the audited local UI and bundled assets remain packaged.
6. Compatibility and security: The server exposes an explicit versioned mobile handshake and permits CORS only for packaged Capacitor origins. Cleartext, Android backups, native debugging, and release logging are disabled.
7. Release identity: Version 0.0.13 and its channel-machine pins, changelog, documentation, native versions, and mobile release checklist are synchronized.

Artifacts

• 1Helm-0.0.13-universal.apk — SHA-256 d06bd599c803df57594103810dc3d33555501b489b684301b5b406b817aed3c7
• 1Helm-0.0.13-arm64.dmg — SHA-256 30b461a816091a0c6d830dc9239fe5572bbbcc55769f2c5c4d2ffd241b24b723
• 1Helm-0.0.13-mac-arm64.zip — SHA-256 bdb2cdf42b473017beddaeec14deae0367864146a9320705ccc05c442d05572f
• 1Helm-0.0.13-linux-node.tgz — SHA-256 5b8ee5411440dad2a1da529dc5a5bee58d6ddaf9419c077880f744445262f573

Android release certificate SHA-256: 7b2d96ab21a242f9b17ddc7c65d133033bb9f0322158b6aab57bf8d46a7d27bf

Verification

• Exact merged source: c4457969ae494dbb82ab29809cb362f5deff3f3b from PR #15.
• Required GitHub Actions verify passed on the exact merged commit.
• Linux: typecheck, build, 117 native-world assertions, 100 broader contracts with one existing environment-only Chrome skip, and onboarding 20/20 passed.
• Mac: typecheck, build, 117 native-world assertions, 99 broader contracts with two Chrome-absence skips, and onboarding 20/20 passed from the clean archive.
• Android: Gradle lint, R8, resource shrinking, zip alignment, v2/v3 signatures, package/version/SDK inspection, permanent certificate fingerprint, clean install, launch, and same-signer update install passed on a native ARM Android 16 emulator.
• Android UI: the rendered app shows the intended HTTPS server, username, and password gateway and states that the password is never saved.
• Apple desktop: app and DMG notarization were accepted; app, updater ZIP, DMG, and mounted app passed strict signature, stapler, and Gatekeeper checks.
• Live demo: /api/mobile/compatibility reports mobile API 1, version 0.0.13, configured, and HTTPS-required.

iOS handoff

The iOS project is ready for npm run package:ios:release, App Store validation, and TestFlight/App Store upload from the exact merged source. The retained Apple Silicon host currently has Command Line Tools only—full Xcode, an Apple Distribution identity, and an App Store provisioning profile are absent. Those Apple prerequisites are intentionally not bypassed, and this release does not publish a generic IPA.