1Helm 0.0.16

1Helm 0.0.16

1Helm 0.0.16 prepares the first App Store candidate with a safe iOS camera
attachment path, deliberate two-row phone chrome, and real opt-in native
notification plumbing. The desktop, Linux, and signed Android artifacts are
also cut from the exact same merged source.

Acceptance ledger

1. Take Photo or Video no longer terminates the iOS app: the native bundle
   now declares camera, photo-library read/add, and recorded-video microphone
   access with narrow user-facing explanations tied to explicit attachment
   actions. The exported App Store IPA contains all four declarations.
2. The phone channel header is now two rows: hamburger and channel name are
   on the first row; Favorite, Router, resident status, Terminal, Notes, and
   Skipper are right-aligned on the second. All phone actions retain 44-point
   targets with no horizontal overflow, the header color continues behind the
   Dynamic Island, and Notes keeps New note and Close below the system
   indicators.
3. Native iPhone notifications are implemented as explicit opt-in: each
   APNs token belongs to the signed-in user and individual phone, disabling or
   disconnecting one phone does not unregister another, foreground WebSocket
   events remain authoritative, and tapping a push opens its channel/thread.
   Durable server fan-out skips the sender, honors per-channel mute, treats
   global mute as sound-only, waits for settled resident replies, deduplicates
   messages, and retries transient delivery failures. The production relay
   encrypts device tokens, uses opaque recipient IDs, rate-limits requests,
   atomically claims idempotency keys, and removes permanently invalid tokens.

Public artifacts

• 1Helm-0.0.16-universal.apk — 4,427,352 bytes — SHA-256
  6902d1bed6b21551049e9aa6242eec6835dd440a040b4cced1b7093cc6004ea1
• 1Helm-0.0.16-arm64.dmg — 244,344,150 bytes — SHA-256
  252c2d7ba28f289ef8f329b89b4c6b9702cd724d8afd09203bc155d68a22c21a
• 1Helm-0.0.16-mac-arm64.zip — 184,675,766 bytes — SHA-256
  c6e303f07e1e2bc9b86659c8a193ed9eb02eeba6455838707a4870db0c8d8ddf
• 1Helm-0.0.16-linux-node.tgz — 19,011,881 bytes — SHA-256
  8c9bb54d7b9fabc895d2bf077a863841689e37e294035e3e75e1bf9a29112cc8

Android release-certificate SHA-256:
7b2d96ab21a242f9b17ddc7c65d133033bb9f0322158b6aab57bf8d46a7d27bf

Verification

• Exact merged source: f0f9a97cacef417a6d55c0538c5a005b3b55d2c2
  from PR #18; tag v0.0.16 points to that commit.
• GitHub Actions verify and all CodeQL jobs passed on the pull-request source;
  CI and CodeQL also passed on the exact merged commit.
• Linux: typecheck, build, mobile sync, 117/117 native-world assertions, 101
  broader contracts with two environment-only browser skips, onboarding 20/20,
  phone/Notes browser regression coverage 39/39, and the focused mobile push
  and relay contracts passed.
• Mac clean APFS build: typecheck, build, 117/117 native-world assertions, 101
  broader contracts with two environment-only skips, and onboarding 20/20
  passed from the exact source archive.
• Apple desktop: the app and DMG were Developer ID signed, Apple-notarized,
  stapled, and accepted by strict signature checks and Gatekeeper; the updater
  ZIP's extracted app and the app mounted from the DMG passed the same checks.
• Android: the release APK passed 16 KiB alignment, v2/v3 signature,
  application ID, version/build, universal ABI, and permanent-certificate
  verification. A fresh emulator boot was unavailable on this Linux host
  because hardware virtualization is not exposed; no Android behavior changed
  beyond receiving the shared notification plugin dependency.
• Live demo: https://demo.1helm.com, its configured workspace health endpoint,
  and its update endpoint report successfully from version 0.0.16.

iPhone and App Store status

The exact merged App Store IPA was exported and independently validated as
com.gitcommit90.onehelm.mobile, version/build 0.0.16 (16), arm64, with an
App Store distribution profile and aps-environment=production. Its SHA-256 is
b9bce8b9ccf30dfc68aebfd86f02d7864ffdd3041a016e6f32bd646fe9724f41.
The IPA is intentionally not a public GitHub asset.

App Store upload remains gated on the one-time App Store Connect app record
and real-device acceptance while the MacBook Air is offline. End-to-end
background notification delivery additionally requires deploying the included
Cloudflare D1 migration/Worker with an Apple APNs server key. These external
gates are not represented as completed by this source release.